From ed3fee06e803b4a1775f6b634529ff020883c5ab Mon Sep 17 00:00:00 2001 From: Fabio Scotto di Santolo Date: Fri, 2 Oct 2026 17:47:40 +0200 Subject: [PATCH] Record operator-validated Gitea SSH pull and push --- AGENTS.md | 6 ++++-- README.it.md | 4 ++-- README.md | 3 ++- docs/atlas-gitea-migration.md | 4 +++- 4 files changed, 11 insertions(+), 6 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 64d0e62..3cd5ba4 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -332,8 +332,10 @@ successfully. The first monthly scrub remains a runtime check. firewall was opened on 2026-10-02, TCP/2222 connected, the public ED25519 host-key fingerprint matched Atlas, Gitea authenticated `fscotto` using the `ikaros` key, and `git ls-remote` returned HEAD for `fscotto/infra.git` over public SSH. -- [ ] Validate a representative authenticated SSH push and HTTPS write/login before declaring - the full cutover complete. Do not push to an existing repository merely as a test. The +- [x] Validate authenticated SSH pull and push. On 2026-10-02 the operator reported both + operations working through the public SSH endpoint; the earlier agent-run `git ls-remote` + remains the independent read-only check. The agent did not perform a test push. +- [ ] Validate HTTPS write/login before declaring the full cutover complete. The secondary NPM hostname `git.ov-ad3410.infomaniak.ch` did not resolve from Ikaros and had no generated NPM config file at the previous inspection. Do not restart the stale source Gitea after Atlas has accepted writes. diff --git a/README.it.md b/README.it.md index 52c5a93..0614098 100644 --- a/README.it.md +++ b/README.it.md @@ -326,8 +326,8 @@ La migrazione Gitea da Prometheus ad Atlas è descritta in [`docs/atlas-gitea-migration.md`](docs/atlas-gitea-migration.md). Gitea usa un Quadlet rootless di `admin` su un dataset dedicato; l'immagine derivata mantiene UID/GID 1000 ma chiama l'utente interno `gitea`. NPM resta su Prometheus e l'HTTPS pubblico primario serve Atlas. L'SSH pubblico -su TCP/2222 autentica la chiave `ikaros` e un `git ls-remote` è riuscito; restano da provare -push autenticato e scrittura via HTTPS prima di considerare completo il cutover. I dati sorgente restano +su TCP/2222 autentica la chiave `ikaros` e un `git ls-remote` è riuscito; l'operatore ha +confermato pull e push SSH. Resta da provare la scrittura via HTTPS. I dati sorgente restano conservati su Prometheus senza avviarne il vecchio container. Validare il gateway con: diff --git a/README.md b/README.md index fe6d169..474e235 100644 --- a/README.md +++ b/README.md @@ -303,7 +303,8 @@ The Gitea move from Prometheus to Atlas is tracked in Atlas' dedicated dataset under `admin`'s rootless user Quadlet. Its pinned derived image uses an internal Unix user named `gitea` (UID/GID 1000), while clone URLs keep `git@`. NPM remains on Prometheus and the primary public HTTPS route serves Atlas. Public SSH/2222 now authenticates the `ikaros` key and serves -read-only `git ls-remote`; authenticated push and HTTPS writes remain untested. The old Gitea data remains on Prometheus, but its container +read-only `git ls-remote`; the operator also confirmed SSH pull and push. HTTPS writes remain +untested. The old Gitea data remains on Prometheus, but its container is absent from the desired stack. The separate `wireguard_overlay` role manages `wg0` between Prometheus (`10.0.0.1`) and Aegis diff --git a/docs/atlas-gitea-migration.md b/docs/atlas-gitea-migration.md index 4ba4f8b..86559b0 100644 --- a/docs/atlas-gitea-migration.md +++ b/docs/atlas-gitea-migration.md @@ -146,7 +146,9 @@ test no SYN reached Prometheus `eth0`; its socket and firewalld port were active After the VPS firewall was opened later on 2026-10-02, the public port connected, its ED25519 host-key fingerprint matched Atlas, Gitea authenticated the `ikaros` key as `fscotto`, and a public SSH `git ls-remote` for `fscotto/infra.git` -returned HEAD. Authenticated push and HTTPS write/login remain untested. Do not +returned HEAD. The operator subsequently reported successful authenticated +SSH pull and push; the agent did not perform a write test. HTTPS write/login +remain untested. Do not restart the stale source after public HTTPS has accepted target writes. The Prometheus export timer resumed with NPM-only paths. A recursive ZFS