From 11cd13cb0855611bb5a32000defe411bda54460d Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sat, 5 Sep 2026 10:44:35 -0600 Subject: [PATCH 1/4] feat: manage Hero host configuration repository --- gh-dependabot.tf | 1 + main.tf | 13 ++++++++----- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/gh-dependabot.tf b/gh-dependabot.tf index 3ee25b6..3c40848 100644 --- a/gh-dependabot.tf +++ b/gh-dependabot.tf @@ -15,6 +15,7 @@ locals { dependabot_ecosystems = { ".github" = ["github-actions"] "cflan" = ["github-actions", "pip"] + "hero-host-config" = ["github-actions"] "images" = ["github-actions", "docker"] "kustomize-cluster" = ["github-actions"] "shared-workflows" = ["github-actions"] diff --git a/main.tf b/main.tf index b713964..f3f278a 100644 --- a/main.tf +++ b/main.tf @@ -9,6 +9,7 @@ locals { "ansible-site-cluster", "ansible-role-crc", "cflan", + "hero-host-config", "charts", "agent-knowledge", "channel-project", @@ -32,12 +33,14 @@ locals { ]) private_github_repositories = toset([ "agent-knowledge", - "channel-project" + "channel-project", + "hero-host-config" ]) topics_by_repository = { ".github" = ["community-health", "github", "org-profile"] "agent-knowledge" = ["agents", "documentation", "knowledge-base", "opencode"] "cflan" = ["cloudflare", "dns", "networking", "networkmanager", "python"] + "hero-host-config" = ["ansible", "cloudflare-zero-trust", "configuration-management", "node-exporter", "rhel", "systemd"] "channel-project" = ["cloudflare", "dns", "opentofu", "video-streaming"] "charts" = ["ghcr", "gitops", "helm", "helm-charts", "oci"] "images" = ["buildah", "containerfiles", "custom-runners", "github-actions", "opentofu"] @@ -46,7 +49,7 @@ locals { "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"] "tfroot-aws" = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-cloudflare" = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"] - "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "sops", "tfstate", "workload-identity-federation"] + "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "s3-backend", "sops", "workload-identity-federation"] "tfroot-github" = ["github-actions", "opentofu", "s3-backend", "sops", "tfstate", "terraform-provider-github"] "tfroot-libvirt" = ["cloud-init", "k3s", "libvirt", "libvirt-provider", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-namecheap" = ["cloudflare", "dns", "domains", "namecheap", "opentofu"] @@ -105,7 +108,7 @@ locals { } "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] + value = data.sops_file.secret_vars.data["onion_secret_access_key"] repositories = ["www"] } "www_s3_bucket" = { @@ -146,12 +149,12 @@ locals { "cloudflare_auth_client_id" = { name = "CLOUDFLARE_AUTH_CLIENT_ID" value = data.sops_file.secret_vars.data["cloudflare_auth_client_id"] - repositories = setsubtract(local.active_github_repositories, toset(["channel-project"])) + repositories = setsubtract(local.active_github_repositories, toset(["channel-project", "hero-host-config"])) } "cloudflare_auth_client_secret" = { name = "CLOUDFLARE_AUTH_CLIENT_SECRET" value = data.sops_file.secret_vars.data["cloudflare_auth_client_secret"] - repositories = setsubtract(local.active_github_repositories, toset(["channel-project"])) + repositories = setsubtract(local.active_github_repositories, toset(["channel-project", "hero-host-config"])) } "chart_updater_github_app_private_key" = { name = "CHART_UPDATER_GITHUB_APP_PRIVATE_KEY" From 6def5a6fcee78f1443d7c50feeca5818aa7c7b53 Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sat, 5 Sep 2026 10:46:27 -0600 Subject: [PATCH 2/4] fix: preserve unrelated GitHub configuration --- main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/main.tf b/main.tf index f3f278a..631dfc7 100644 --- a/main.tf +++ b/main.tf @@ -49,7 +49,7 @@ locals { "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"] "tfroot-aws" = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-cloudflare" = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"] - "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "s3-backend", "sops", "workload-identity-federation"] + "tfroot-gcp" = ["gcp", "kms", "opentofu", "s3-backend", "sops", "tfstate", "workload-identity-federation"] "tfroot-github" = ["github-actions", "opentofu", "s3-backend", "sops", "tfstate", "terraform-provider-github"] "tfroot-libvirt" = ["cloud-init", "k3s", "libvirt", "libvirt-provider", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-namecheap" = ["cloudflare", "dns", "domains", "namecheap", "opentofu"] @@ -108,7 +108,7 @@ locals { } "onion_secret_access_key" = { name = "ONION_AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["onion_secret_access_key"] + value = data.sops_file.secret_vars.data["onion_aws_secret_access_key"] repositories = ["www"] } "www_s3_bucket" = { @@ -128,7 +128,7 @@ locals { } "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] + value = data.sops_file.secret_vars.data["www_secret_access_key"] repositories = ["www"] } "cloudflare_zone_id" = { From eb61ef331ea256c9f3957b4dd65dd837726ad5db Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sat, 5 Sep 2026 10:51:41 -0600 Subject: [PATCH 3/4] fix: preserve existing topic and secret mappings --- main.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/main.tf b/main.tf index 631dfc7..b168049 100644 --- a/main.tf +++ b/main.tf @@ -49,7 +49,7 @@ locals { "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"] "tfroot-aws" = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-cloudflare" = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"] - "tfroot-gcp" = ["gcp", "kms", "opentofu", "s3-backend", "sops", "tfstate", "workload-identity-federation"] + "tfroot-gcp" = ["gcp", "gcs-backend", "opentofu", "sops", "tfstate", "workload-identity-federation"] "tfroot-github" = ["github-actions", "opentofu", "s3-backend", "sops", "tfstate", "terraform-provider-github"] "tfroot-libvirt" = ["cloud-init", "k3s", "libvirt", "libvirt-provider", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-namecheap" = ["cloudflare", "dns", "domains", "namecheap", "opentofu"] @@ -128,7 +128,7 @@ locals { } "www_secret_access_key" = { name = "AWS_SECRET_ACCESS_KEY" - value = data.sops_file.secret_vars.data["www_secret_access_key"] + value = data.sops_file.secret_vars.data["www_aws_secret_access_key"] repositories = ["www"] } "cloudflare_zone_id" = { From 7cd6b7c661f82ac7e779f1be8a21826e2e81dfed Mon Sep 17 00:00:00 2001 From: Steven Welch Date: Sat, 5 Sep 2026 10:52:51 -0600 Subject: [PATCH 4/4] fix: retain tfroot-gcp topic set --- main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.tf b/main.tf index b168049..a322677 100644 --- a/main.tf +++ b/main.tf @@ -49,7 +49,7 @@ locals { "terraform-libvirt-domain" = ["cloud-init", "libvirt", "libvirt-provider", "terraform-module"] "tfroot-aws" = ["aws-provider", "kms", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-cloudflare" = ["cloudflare", "cloudflare-access", "cloudflare-tunnel", "opentofu", "s3-backend", "sops", "tfstate"] - "tfroot-gcp" = ["gcp", "gcs-backend", "opentofu", "sops", "tfstate", "workload-identity-federation"] + "tfroot-gcp" = ["gcp", "gcs-backend", "kms", "opentofu", "sops", "tfstate", "workload-identity-federation"] "tfroot-github" = ["github-actions", "opentofu", "s3-backend", "sops", "tfstate", "terraform-provider-github"] "tfroot-libvirt" = ["cloud-init", "k3s", "libvirt", "libvirt-provider", "opentofu", "s3-backend", "sops", "tfstate"] "tfroot-namecheap" = ["cloudflare", "dns", "domains", "namecheap", "opentofu"]