config: update READMEs and compose files for various services
This commit is contained in:
Hernâni Marques
parent
b19b1d3cf6
commit
2eb44c95d9
12 changed files with 145 additions and 27 deletions
55
2026/2026-09-11--forgejo-gitleaks-enc-gate.md
Normal file
55
2026/2026-09-11--forgejo-gitleaks-enc-gate.md
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
# 2026-09-11 — Forgejo/ht gitleaks + *enc.git Klartext-Sperre (TODO320)
|
||||
|
||||
**Status:** live on koopa Forgejo (`koopa-forgejo` / `git.hacktivism.ch`)
|
||||
**Freigabe:** Auftrag `TODO=320` this session (host mutation ht)
|
||||
**Analog:** firefly/taler `admin-log/firefly/28-gitolite-enc-gitleaks.md` + `hooks/common/pre-receive.d-gitleaks`
|
||||
**Tip:** k stays **319** (no tip-advance)
|
||||
|
||||
## What
|
||||
|
||||
1. **gitleaks** pre-receive on non-`*enc.git` — reject pushes with detected secrets.
|
||||
2. **Skip** `*enc.git` for gitleaks (ciphertext / FP).
|
||||
3. **`git-crypt-enforce`** on `*enc.git` — require `.gitattributes` + `.git-crypt/`; reject blobs under `filter=git-crypt` missing `\0GITCRYPT` (9-byte header).
|
||||
|
||||
## Live paths (koopa)
|
||||
|
||||
| Item | Path |
|
||||
|------|------|
|
||||
| Data root | `~/koopa-forgejo/data` → container `/var/lib/gitea` |
|
||||
| Binary | `data/custom/bin/gitleaks` (v8.21.2 linux_x64) |
|
||||
| Shared hooks | `data/custom/hooks/pre-receive.d/{gitleaks,git-crypt-enforce}` |
|
||||
| Smoke | `data/custom/bin/smoke-todo320.sh` (run **inside** container) |
|
||||
| Per-repo | `data/git/repositories/*/*.git/hooks/pre-receive.d/` → symlinks to shared hooks (container paths) |
|
||||
| Staging / installer SoT | laptop `PATH[llm-configs]/bin/forgejo-hooks/` + koopa `~/koopa-forgejo/hooks-staging/` |
|
||||
|
||||
Installer: `install-hooks-ht.sh` (idempotent; podman; does not restart container).
|
||||
After install: **~32** repos linked. **New repos:** re-run installer (custom/hooks alone not relied on for auto-sync into every bare repo).
|
||||
|
||||
## Smoke (Done-when a/b/c) — PASSED 2026-09-11
|
||||
|
||||
```bash
|
||||
podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh
|
||||
# ALL SMOKES PASSED
|
||||
# (a) secret push denied — private-key fixture (not AWS EXAMPLE keys)
|
||||
# (b) enc ciphertext allowed
|
||||
# (c) enc plaintext denied
|
||||
```
|
||||
|
||||
Fixes needed during smoke: park incoming objects on `refs/tmp/*` (not `refs/heads/*`, else `rev-list tip --not --branches` is empty); magic check `head -c 9` for `\0GITCRYPT`.
|
||||
|
||||
## Rollback
|
||||
|
||||
```bash
|
||||
# Per repo or all: remove custom hooks from pre-receive.d (keep Forgejo `gitea` hook)
|
||||
rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/gitleaks
|
||||
rm -f ~/koopa-forgejo/data/git/repositories/*/*.git/hooks/pre-receive.d/git-crypt-enforce
|
||||
# Optional: remove shared copies under data/custom/hooks/pre-receive.d/
|
||||
```
|
||||
|
||||
## Ops notes
|
||||
|
||||
- Use **podman** (not docker sock) for `koopa-forgejo`.
|
||||
- Symlink targets must be **container** paths (`/var/lib/gitea/custom/...`).
|
||||
- Hook logs redact via gitleaks `--redact`; do not echo secrets.
|
||||
- Laptop SSH: `Host git.hacktivism.ch` ProxyJump koopa, Port 9200, User git.
|
||||
- Local SoT scripts: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`.
|
||||
60
2026/2026-09-12--enc-inventur-rewrite-hooks.md
Normal file
60
2026/2026-09-12--enc-inventur-rewrite-hooks.md
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
# 2026-09-12 — *enc inventur → rewrite → hooks smoke (REPORT ONLY)
|
||||
|
||||
**Status:** report only — **no** admin-log / firefly / Taler push this stretch
|
||||
**Freigabe:** YES rewrite / force-with-lease / hooks; admin-log = report only
|
||||
**Host:** magikoopa (ops) + koopa Forgejo (`koopa-forgejo`)
|
||||
**Credit stand:** PCT=0.0 @14:29 renew (authoritative); host `/c` also 0%
|
||||
**Inventur park:** `$HOME/git/llm/llm-work-input/tmp/enc-inventur-20260912-STATUS.txt`
|
||||
|
||||
## Priority table (tip)
|
||||
|
||||
| Priority | Repo | Outcome |
|
||||
|----------|------|---------|
|
||||
| 1 | `grok-work-log-credit-enc` | **DONE** — was Klartext; git-crypt + orphan tip `877d3e7`; force-with-lease to `hernani/grok-work-log-credit-enc.git` (`e21c1fe`→`877d3e7`). Subject: `git-crypt: encrypt *enc tree (attrs+keys; wipe plain remote next)`. Dirty parked on `backup/pre-crypt-20260912` (`7f00501`). |
|
||||
| 2 | `llm-work-output-enc` | **ORIGIN FIXED** — was empty index + wrong origin `hernani/git.git`. Reattached: clone correct `hernani/llm-work-output-enc.git`, unlock, overlay live. Tip `f853969` already `\0GITCRYPT`. `ORIGIN_OK` `LAYOUT_OK`. Local dirty overlay ≈2090 (not pushed this turn). |
|
||||
| 2 | `llm-control-data-enc` | **LOCAL CRYPT ONLY** — wrong origin cleared; `git init` + sibling attrs + both GPG users; tip `6aec2c7` (encrypted `status.json`/`stats.json`/sqlite). Origin URL set to `hernani/llm-control-data-enc.git`. **Forgejo repo MISSING** — **no push** until create Freigabe. |
|
||||
| 3 | `osaurus-work-log-enc` | **OPEN** — tree at `$HOME/git/llm/llm-work-logs/osaurus-work-log-enc`; no commits, no attrs/crypt, no usable remote. |
|
||||
| 3 | `freenotes-data-enc` | **OPEN** — tree at `$HOME/git/src/freenotes-data-enc`; has `.gitattributes` + `.git-crypt`; **NO_REMOTE**. |
|
||||
| tip OK | `dot-grok-enc`, `secrets-enc` family, `buerokratie-enc`, `llm-work-db-data-enc`, `grok-work-log-enc`, (+ credit-enc now) | tip encrypted; history-clean handoff list unchanged for remaining. |
|
||||
|
||||
## Wrong origin (cleared)
|
||||
|
||||
Both control + output previously pointed at **`hernani/git.git`** (ASC board). Cleared. **HALT** remains: never force-push *enc content to `hernani/git.git`.
|
||||
|
||||
## Hooks (TODO320) — reinstall + smoke 2026-09-12
|
||||
|
||||
Installer SoT: `$HOME/git/llm/llm-configs/bin/forgejo-hooks/`
|
||||
Synced → koopa `~/koopa-forgejo/hooks-staging/` → `install-hooks-ht.sh`
|
||||
|
||||
```
|
||||
OK gitleaks=8.21.2 repos_linked=32
|
||||
podman exec koopa-forgejo /var/lib/gitea/custom/bin/smoke-todo320.sh
|
||||
ALL SMOKES PASSED
|
||||
(a) secret push denied
|
||||
(b) enc ciphertext allowed
|
||||
(c) enc plaintext denied
|
||||
```
|
||||
|
||||
`grok-work-log-credit-enc.git` bare has `pre-receive.d/{gitleaks,git-crypt-enforce}` symlinks.
|
||||
Bare `hernani/llm-control-data-enc.git` **absent** on Forgejo (matches ls-remote MISSING).
|
||||
|
||||
**Re-smoke 2026-09-12T15:37Z:** `ALL SMOKES PASSED` again (a deny secret / b allow ciphertext / c deny plaintext).
|
||||
Inventur STATUS close block appended same turn.
|
||||
|
||||
## GPG recipients (credit + control)
|
||||
|
||||
- `31733E0C598D3A1CF70955D6CB5738652768F7E9` (pep)
|
||||
- `8DB88672C5C9FD08373194B6EA1C30038C1D6498` (magikoopa)
|
||||
|
||||
## Blocked / needs next Freigabe
|
||||
|
||||
1. **Create** Forgejo `hernani/llm-control-data-enc` (private) → then first push of `6aec2c7` + re-run installer for new bare hooks.
|
||||
2. Optional: commit/push work-output dirty overlay (2090) after review.
|
||||
3. P3: osaurus init+crypt+remote; freenotes add correct remote + push policy.
|
||||
4. Admin-log **push** of this file (report-only until Freigabe).
|
||||
|
||||
## HALT (unchanged)
|
||||
|
||||
- No ladder restart `@START_N=333`
|
||||
- No admin-log / firefly / Taler push without Freigabe
|
||||
- No force-push to `hernani/git.git`
|
||||
Loading…
Add table
Add a link
Reference in a new issue