head

Release head

Tags:

Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

Merge the reusable hugo_landing project into the main site: its shared canvas and accent styles and its landing page rules move into the apex tree, and its landing macro, generated configuration, standalone publisher, and repository-relative rewrite layouts are removed. The theme keeps owning the taxonomy and term layouts, which are richer than the heading-only versions the reusable project carried. Remove the now-unused apex deploy_project.sh and deploy_all.sh landing publishers with it.

Retire the per-project publication and DNS ownership: the project landing targets and the landing deployment command, each landing project’s dnsconfig.json and Terraform root, the build plumbing that served only those stages, and the landing repository and Pages membership in the repository catalog. The apex Terraform root is retained because it also declares VM resources, and no Vault configuration is changed.

Replace the provider-snapshot zone files with generated declaration pages, one per destination view, that project the checked-in declarations and are verified for freshness by the DNS offline check. The DNS linter, both destination pages, the apex site, the skills projection, and the repository quality suite pass, and the whole repository builds.

OpenSpec-Change: projects/alwaldend.com/openspec/changes/consolidate-project-landings-into-apex

LLM-disclaimer: This commit was generated by an LLM.

Manage forge resources with hermetic Terraform rules

Centralize organization, repository, and named access configuration in infra/repos. Adopt existing GitHub resources, protect master defaults while retaining Pages publication on pages, and preserve existing repository identities. Manage GitLab one-time imports, the F-Droid metadata fork, and default-branch protections through Vault-backed authentication. Forgejo consumes the same catalog. Ongoing repository synchronization is deferred.

Retire the eleven Bazel rule landing sites through their owning Terraform workflows, removing their DNS records, Pages repositories, and landing configuration. Move all twelve existing standalone rule modules into tools/ and retain their public interfaces and documentation on the main site.

Add tools/rules_terraform with verified provider downloads, packed mirrors in runfiles, and reusable Terraform execution rules. Enforce one version per provider source at an extensible resolution boundary. Migrate every Terraform consumer to thirteen shared provider pins in third_party/terraform. Execution and command maps belong to rules_terraform; consumers explicitly select generic AL wrappers for authentication and Vault injection. Remove tools/terraform and all 43 checked-in Terraform provider locks. Validate installed providers against the declared archives before execution.

Validation covers all fourteen workspace builds, all thirteen standalone test suites, Terraform consumers, offline real-provider regressions, rendered documentation, formatting, and semantic lint. The full root test run has 295 passing tests and one skip; its only failure is the historical secret scan, reduced to four pre-existing synthetic fixture matches. Earlier live imports and the exact landing retirement scope have verified postconditions; the Terraform rules migration uses only offline implementation checks.

OpenSpec-Change: infra/repos/openspec/changes/archive/2026-09-13-adopt-shared-repository-catalog OpenSpec-Change: infra/src/openspec/changes/archive/2026-09-13-retire-bazel-rule-landings OpenSpec-Change: tools/rules_terraform/openspec/changes/archive/2026-09-14-add-hermetic-terraform-rules OpenSpec-Change: tools/rules_terraform/openspec/changes/archive/2026-09-14-correct-terraform-ownership

LLM-disclaimer: This commit was generated by an LLM.

Deploy project DNS through Terraform modules

Move DNS ownership into each project’s Terraform state using shared modules. Load dnsconfig.json files at runtime, reject conflicting domain ownership, and render their records as a table. Add missing project AppRoles and scoped DNS policies, and document grouping related Terraform resources in modules.

Deploy all 45 owners sequentially: adopt 155 existing records and create 13 missing OpenHands records. Preserve every pre-existing provider record and verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply wrappers with a saved-plan guard for roots that also manage services. Allow bounded aggregate path inventories large enough to deliver this migration while retaining truncation refusal in the delivery tool.

Validate runtime ownership, provider imports and preservation with isolated fixtures, Terraform formatting, wrapper builds, repository quality checks, semantic lint, and project documentation/specification builds.

OpenSpec-Change: infra/dns/openspec/changes/archive/2026-09-13-migrate-project-dns-to-terraform

LLM-disclaimer: This commit was generated by an LLM.

Simplify OpenSpec workspace globs

Collapse OpenSpec source globs to specs and changes, drop redundant package visibility blocks already covered by REPO.bazel, and regenerate the affected catalogs.

LLM-disclaimer: This commit was generated by an LLM.

Publish project sites and reproducible infrastructure diagrams

Build and deploy all 30 remaining project sites with the standard Docsy header, project descriptions and a linked documentation directory. Omit the repeated page title and generated language heading. Remove the unused cgit and xray_manager projects and retire their site resources.

Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct GitHub Pages DNS records. Preserve repeated publication when pages is the remote default branch, and include Rules ISO in the main documentation. Document site onboarding in a registered, validated skill. Keep AL introduction short with useful links and preserve its lifecycle details in a dedicated documentation page.

Render all 15 existing infrastructure Drawio pages with pinned Drawio and Chrome inputs, sandboxed export actions, an update target and freshness checks, and include the maintained diagrams in infra/arch documentation. Paint an opaque white canvas to preserve readability in dark themes.

Validation covers project and apex builds, rendered pages, publisher tests, diagram repeatability and freshness, DNS configuration, Terraform formatting, semantic lint and repository quality.

Goal-Ref: build-and-deploy-every-project-landing-page-a782b800 Attempt-ID: attempt-00941092c164

LLM-disclaimer: This commit was generated by an LLM.

Wait for AL secret cleanup and plugin shutdown

Roll back partial plugin startup, drain requests before releasing resources, and wait for plugin and command processes to exit. Stop independent plugins concurrently while preserving dependency order inside each plugin.

Revoke invocation-owned credentials, remove temporary secret files, and verify Forgejo and Harbor session cleanup. Preserve the user’s existing Vault login. Enforce Vault OIDC origins and no_auth, redact sensitive errors, and restrict config dumps to owner-only files. Add the AppRole SecretID cleanup permission.

Cover normal exit, cancellation, failed startup, credential revocation, and transport cleanup with synthetic unit and real command/plugin regression tests.

Clarify that required formatting-only repairs need no separate approval, and fix the existing blank-line formatting failure in the GitHub AL wrapper.

Goal-Ref: fix-al-secret-lifecycle-and-plugin-shutdown-3137c0b0 Attempt-ID: attempt-0c1353676e2f

LLM-disclaimer: This commit was generated by an LLM.

Extract DNSControl setup into rules_dnscontrol

Extract the DNSControl setup into rules_dnscontrol, generate its Bazel dependency bundle from project-owned record files, and update the DNS guidance. Move Hugo rules and the worker to role-based package paths, and give each non-nested project a locally owned Hugo landing target that reuses the shared README-to-landing macro.

Clean all landing and Pages DNS records so GitHub Pages serves each project subdomain directly without Cloudflare proxying. Improve the main site with a three-panel home layout, complete project links, documentation explore links, and current deployment guidance.

All affected root-workspace landing, DNS, and site targets pass, along with the nested rules_hugo tests, Buildifier, and repository quality checks.

LLM-disclaimer: This commit was generated by an LLM.

Add standalone documentation rules

Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.

Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.

Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.

This commit was generated by an LLM.

Set up Split Horizon DNS, refactor IDM a bit

Add //third_party/org_fedora_cloud, fix alwaldend.com roles

Set up unikernel deploy

Add signing policy to vault_pki_server

Update cluster token ttl, update secrets

Add sops, add vault_transit_key, add sops to fluxcd

Add k3s_auth configs

Add admin group for the flux cluster

Use a custom traefik deploy instead of the bundled one

Deploy ClusterIssuer for cert-manager

Rewrite k3s role, finish flux deploy

Add optional disk mount to traefik and forgejo, add ceph disks to forgejo VMs

Enable asyncio=native, iothread, emulatessd, discard, add ceph disk support

Disable firewalld in firewall role

Move gateway into pve_vm_qemu

Move pve to //infra/pve, remove //infra/dc1

Remove consul IaC

Add harbor_login, add harbor IaC, fix bazel’s certificates

Add drawio-desktop, add //infra/arch, update opencode restrictions

Finish the forgejo role

Finish the traefik role

Add fp modules, refactor tf backend to use it, add parallel start of plugins, add lock check to the backend

Improve consul deploy, improve vault approles

Migrate proxmox resource to separate resource pools, add a vm module

Create folders and resource pools from approle config instead of duplication

Set up automated PVE login using OIDC, remove PVE tokens

Fix pve firewall, add //infra/dc1/consul1, standardize ssh and pki roles

Add timezone management to the host role and TrustedUserCAKeys to the ssh role

Set up OIDC with Vault as provider

Set up ACME, disable mTLS for Vault

Automate root token generation, split the main vault policy into separate ones

Move vault tools to //tools/vault, replace go_binary in al_binary with native_binary

Fix cert auth entities, reformat all tf files

Set up client certificate generation, move ica to a separate module

Add backup_bucket module, add rclone, set up backups for Vault

Migrate all resources to separate terraform-managed cloud folders

Add yc_folder terraform module, migrate to it

Migrate Vault to Raft storage, start setting up backups, add postgresql role

Migrate some docs target to the new macro

Write a proper runner for terraform and vault, set up s3 backends for terraform

Refactor approle management into a terraform module

Initial commit

Add spellcheck skill

This commit was generated by an LLM.

Restore light and dark site canvases and set the shared accent

The shared Docsy canvas set the same Bootstrap dark palette and the same black page background on :root, [data-bs-theme="light"], and [data-bs-theme="dark"], so the light/dark toggle changed nothing. The site also rendered Bootstrap’s stock blue instead of its intended accent.

Split the shared palette so light mode uses a pure white canvas with the light-mode palette and dark mode uses a pure black canvas with the dark-mode palette, and keep the pre-stylesheet paint and footer on the active mode. Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons, badges, focus rings, and the dark-mode link tint all derive from one value rather than from a site-local copy.

Both files stay in the reusable shell; the apex site consumes them through the existing declared exports and no longer carries the footer’s own blue.

OpenSpec-Change: projects/hugo_landing/openspec/changes/restore-light-dark-canvas-and-accent

LLM-disclaimer: This commit was generated by an LLM.

head

Changelog52

Artifacts0