feat(config): routing as a named-project file, and push rights minted per Run #28

Closed

ryangr0 wants to merge 0 commits from agent/config-and-tier2 into development

ryangr0 commented

2026-07-29 19:18:38 +00:00

Owner

Two things asked for directly, plus the ADR the second needed.

Configuration moves out of environment variables

PLOEG_TARGET_MAP, PLOEG_TEAM_MAP and PLOEG_TEAM_PLANS were three hand-rolled DSLs with no schema, no comments and no reviewable diff. They become one YAML file, rendered from Helm values into a ConfigMap and mounted at /etc/ploeg/ploeg.yaml. A typo'd key now fails the boot instead of silently taking a default.

The sharper half is the magic numbers. 11/bronze=webgrip/ploeg@development put a Vikunja project ID into cluster config, where a bare 11 says nothing about which board it is, cannot be reviewed, and silently routes work to the wrong repository the day that project is rebuilt. Projects are named now — ploegd asks the tracker for the id at boot, logs what it resolved, and refuses to start if the name matches nothing, with the available names in the error. id: remains as an escape hatch.

Renders to the same wire format pkg/target already parses, so there is one routing resolver, not two that drift. Env vars still work when the file is absent.

Push rights are minted per Run (ADR-0013 tier 2)

Tier 1 gave readers a weaker static token. This closes the other hole: a writer pod partitioned from ploegd keeps running after its Lease expires, and with a shared credential it can still push to a branch another Run has taken over.

A writing Run now gets a write:repository token minted for it alone, named ploeg-run-<12hex>-<repo> so a token in the Forgejo UI traces to a Run, a Shift and a ticket. Revoked on report, on lease expiry by the sweeper, and by a boot sweep — the same three-layer shape ADR-0008 uses for spend.

If the mint fails, nothing runs: the Run finishes as a retryable infra failure and the pod exits empty-handed, rather than proceeding with a credential we did not intend to hand out. Readers get nothing minted.

The admin credential lives only in ploegd, never in a worker pod (R6) — a real escalation, accepted explicitly by ADR-0013 on ADR-0008's reasoning. Unset, everything falls back to the shared token, so this ships dark.

Honest limitation, recorded in the code: Forgejo scopes tokens by permission, not by repository, so the repo in the token name is audit rather than enforcement — the bot's own access still bounds it.

ADR-0017 flipped proposed → accepted: its implementation merged in #26.

Gates

gofmt, go vet, go build, go test ./... (19 packages), helm lint, three renders, and ./scripts/helm-golden.sh check — all green.

Two things asked for directly, plus the ADR the second needed. ## Configuration moves out of environment variables `PLOEG_TARGET_MAP`, `PLOEG_TEAM_MAP` and `PLOEG_TEAM_PLANS` were three hand-rolled DSLs with no schema, no comments and no reviewable diff. They become one YAML file, rendered from Helm values into a ConfigMap and mounted at `/etc/ploeg/ploeg.yaml`. A typo'd key now fails the boot instead of silently taking a default. The sharper half is the magic numbers. `11/bronze=webgrip/ploeg@development` put a Vikunja project ID into cluster config, where a bare `11` says nothing about which board it is, cannot be reviewed, and silently routes work to the wrong repository the day that project is rebuilt. Projects are **named** now — ploegd asks the tracker for the id at boot, logs what it resolved, and refuses to start if the name matches nothing, with the available names in the error. `id:` remains as an escape hatch. Renders to the same wire format `pkg/target` already parses, so there is one routing resolver, not two that drift. Env vars still work when the file is absent. ## Push rights are minted per Run (ADR-0013 tier 2) Tier 1 gave readers a weaker static token. This closes the other hole: a writer pod partitioned from ploegd keeps running after its Lease expires, and with a shared credential it can still push to a branch another Run has taken over. A writing Run now gets a `write:repository` token minted for it alone, named `ploeg-run-<12hex>-<repo>` so a token in the Forgejo UI traces to a Run, a Shift and a ticket. Revoked on report, on lease expiry by the sweeper, and by a boot sweep — the same three-layer shape ADR-0008 uses for spend. **If the mint fails, nothing runs**: the Run finishes as a retryable infra failure and the pod exits empty-handed, rather than proceeding with a credential we did not intend to hand out. Readers get nothing minted. The admin credential lives only in ploegd, never in a worker pod (R6) — a real escalation, accepted explicitly by ADR-0013 on ADR-0008's reasoning. Unset, everything falls back to the shared token, so this ships dark. **Honest limitation, recorded in the code:** Forgejo scopes tokens by permission, not by repository, so the repo in the token name is audit rather than enforcement — the bot's own access still bounds it. ADR-0017 flipped `proposed` → `accepted`: its implementation merged in #26. ## Gates `gofmt`, `go vet`, `go build`, `go test ./...` (19 packages), `helm lint`, three renders, and `./scripts/helm-golden.sh check` — all green.

ryangr0 referenced this pull request from webgrip/homelab-cluster

2026-07-29 19:19:28 +00:00

[BLOCKED: fill in the chart pin] feat(ploeg): route by named projects, write back to the board #470

ryangr0 closed this pull request

2026-07-29 19:20:41 +00:00

On Pull Request / checks (pull_request) Successful in 4m56s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/ploeg!28

No description provided.

Rows
Columns