Will Anderson
939e66bfbb
act_runner cannot inject custom HTTP headers, so CF Access blocks its unauthenticated calls to git.neuralplatform.ai. Add a gitea-proxy deployment (nginx:alpine) in the ci namespace that injects the CF Access service-token headers and proxies to https://git.neuralplatform.ai. Both runner secrets now point GITEA_INSTANCE_URL at the in-cluster proxy (http://gitea-proxy.ci.svc.cluster.local:3000). Build containers still clone via SSH through git-ssh-init.sh — unaffected.
infrastructure
Personal infrastructure-as-code for Legion (k3s home server) and supporting tooling.
| Doc | What it covers |
|---|---|
AGENTS.md |
Full reference: machines, secrets, services, domains, namespaces, common operations |
servers/legion/README.md |
What's running on Legion and how deployment works |
servers/legion/RUNBOOK.md |
Disaster recovery — full restore from scratch |
Quick start
cd servers/legion
direnv allow
terraform plan
terraform apply
Push to servers/ to deploy app changes via Argo CD.