claude-botandClaude Opus 5.5
76a82f7d28
The sidecar took its git remote, Gitea API base and token from a URL with an embedded PAT stored on the config PVC. That state was invisible to git, unrotated, and would break on the repo transfer to konairius: the live -> main PR is opened with an API POST, and Gitea API writes do not survive the old-path redirect (seen with the wiki on notes). - ha-config-sync: dedicated Gitea account, write collaborator on homeassistant. CronJob openbao/ha-config-sync-secret-rotate (quarterly) mints its write:repository PAT, verifies pull+push on homeassistant and stores it at infrastructure/ha-config-sync#token. Policy/role applied and the path seeded on 2026-10-18. Netpol halves gitea-allow-ha-config-sync-rotator and rotator-ha-config-sync-egress. - ExternalSecret home-assistant-config-sync-gitea, mounted as a file (not subPath) so a rotation lands in place without restarting Home Assistant. - config-sync.sh: GITEA_URL/GITEA_REPO/GITEA_USER/GITEA_TOKEN_FILE from the manifest; the remote is reset to the credential-free URL on every start; git gets the token as an http.extraHeader through GIT_CONFIG_* env, re-read every loop; the PR call uses the same token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>