claude-botandClaude Opus 4.8
287e01a95c
Stand up Gitea + Woodpecker as in-cluster workloads beside the existing Proxmox LXCs WITHOUT flipping any traffic. Both Services remain ExternalName -> the LXCs, the Woodpecker agent ships replicas:0, and the gitea SSH IngressRouteTCP is absent. Merging this changes nothing user-facing — Flux brings up empty-PVC pods that get loaded and verified out-of-band before a phase-2 PR flips the Services to ClusterIP. Gitea: gitea/gitea:1.21.4-rootless (its entrypoint runs environment-to-ini, so do NOT override it), built-in SSH server on 2222, forced GITEA__log__ROOT_PATH, host-key reuse. Traefik gains an additive gitea-ssh TCP entrypoint (:22 on the shared VIP). Woodpecker: kubernetes backend (build pods in ns woodpecker-ci on ceph-filesystem RWX, privileged-plugin allow-list + PodSecurity label), agent replicas:0; SOPS secret is created+committed at pre-flight, never kubectl-applied. Cutover is fully GitOps: flux suspend + kubectl exec/scale data load, verify via port-forward, phase-2 flip with a repo-resync; break-glass = repoint the Flux source to the GitHub mirror (known-good tag before-k8s-migration). See kubernetes/apps/MIGRATION-gitea-woodpecker.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HQhvu1mrQ7EgwLhrzdNyY7