XeplosionTechnologies/.forgejo

Watch

Fork

You've already forked .forgejo

Code Issues 19 Pull requests Projects 5 Releases Packages Wiki Activity Actions

Complete post-migration infrastructure baseline #40

New issue

Open

opened 2026-09-07 22:29:05 +00:00 by Xeplosion · 1 comment

Xeplosion commented

2026-09-07 22:29:05 +00:00

Owner

Copy link

Type of chore

Other

What needs to be done and why?

Perform a final infrastructure baseline review after the Forgejo, runner, deployment, account, and CI/CD migrations.

The previous infrastructure issue combined many implementation tasks across both servers and Forgejo. A significant portion of that work has already changed or been completed, and remaining security/automation work now has more focused owners.

This issue should therefore act as a migration closure and baseline audit, not repeat the old implementation plan.

The goal is to answer:

Is the current infrastructure internally consistent, documented, recoverable, and free of unintended dependencies on the retired architecture?

Forgejo baseline

Confirm Forgejo is running on the intended current host.
Confirm the retired Forgejo instance is no longer an unintended dependency.
Confirm DNS reflects the current topology.
Confirm reverse-proxy routing reflects the current topology.
Confirm current data paths are documented.
Confirm current service configuration is documented.
Remove or archive obsolete migration-only configuration.

Forgejo runners

Inventory current runners.
Confirm each runner is registered against the correct Forgejo instance.
Confirm runner labels.
Confirm workflows route to the correct runner.
Confirm runner accounts match the current isolation model.
Remove obsolete runner registrations.

Network / routing

Confirm current WireGuard/internal routing.
Confirm required service-to-service connectivity.
Confirm obsolete proxy paths are no longer required.
Confirm firewall rules match the current architecture.
Document intentional cross-host dependencies.

Service ownership / permissions

Confirm service ownership on each managed host.
Confirm obsolete shared-account dependencies are either removed or tracked.
Link remaining service-isolation work to the dedicated security issue.
Confirm current deployment paths match the intended architecture.

Forgejo configuration / credentials

Confirm current organization variables.
Confirm current repository-scoped deployment configuration.
Link remaining credential-isolation work to its dedicated issue.
Confirm retired credentials are no longer required.

Backup / recovery

Confirm Forgejo backups cover the current host and data paths.
Confirm backup retention is appropriate.
Confirm restoration documentation reflects the current topology.
Confirm runner/configuration recovery requirements are documented.
Perform or schedule a recovery validation if the current architecture has not been tested.

Documentation

Review infrastructure documentation for obsolete hostnames.
Review infrastructure documentation for retired service users.
Remove obsolete deployment patterns presented as current.
Confirm documentation distinguishes current and bespoke/legacy systems.
Ensure Wiki guidance points to the current infrastructure model where appropriate.

Cleanup / closure

Identify orphaned configuration left from migration.
Identify obsolete services/files.
Remove obsolete state only after verifying it is unused.
Create separate issues for newly discovered substantial work.
Link all remaining follow-up issues.
Record a final infrastructure-baseline summary.

Technical-debt impact

Migration remnants become hidden dependencies over time.

Without a clear post-migration baseline, future incidents and infrastructure changes require rediscovering which parts of the old architecture are still meaningful.

Risk / compatibility impact

The audit itself is low-risk, but cleanup actions may affect production infrastructure.

Potentially destructive or high-risk discoveries should be split into focused issues and reviewed independently.

Affected branch(es)

Not primarily branch-specific.

Repository/documentation changes discovered during the audit should use their respective branch workflows.

Additional context

The old infrastructure issue mixed Forgejo migration, runner setup, service accounts, credentials, repository protection, and docs-branch creation in one checklist.

This replacement is intentionally a governing closure issue. Focused security and automation work should remain in their dedicated issues.

Request checklist

I described why this work provides value or avoids future technical debt
I identified known risk, compatibility, or coordination concerns where applicable

Workflow lifecycle

Triage

Kind/ classification confirmed
Issue validity reviewed and appropriate Reviewed/ label assigned
Priority/ assigned when appropriate
Implementation branch referenced on the issue through Forgejo when applicable
Information requirements resolved; no Status/Needs More Info remains
Status/Needs Triage removed before leaving Triage

Backlog

Issue is confirmed valid and accepted into the project backlog

To Do

Scope and expected outcome are sufficiently defined
Known prerequisites, dependencies, and required decisions are resolved or understood
Work has been deliberately selected as upcoming work

In Progress

Assignee or active owner identified when appropriate
Forgejo timer started when time tracking provides meaningful value
Relevant implementation, research, or work notes recorded as needed
Forgejo timer stopped when active work ends, pauses, or becomes blocked

Review Gate

Review requirement assessed based on complexity, criticality, reversibility, and impact
If review is required: moved to In Review and appropriate testing / validation performed
If review is required: review comment records what was reviewed, how it was validated, findings, and outcome
If review is not required: rationale is evident from the low-risk nature of the change

Completed

Acceptance criteria / intended outcome satisfied
Related PRs, commits, documentation, or external changes linked where applicable
Resolution is documented by a linked PR that closes the issue, or by a final issue comment explaining what changed, how it was resolved, and how it was verified
Follow-up work split into separate issues where appropriate
Any Forgejo timer is stopped and recorded time is final
Issue moved to Completed and closed

### Type of chore Other ### What needs to be done and why? Perform a final infrastructure baseline review after the Forgejo, runner, deployment, account, and CI/CD migrations. The previous infrastructure issue combined many implementation tasks across both servers and Forgejo. A significant portion of that work has already changed or been completed, and remaining security/automation work now has more focused owners. This issue should therefore act as a **migration closure and baseline audit**, not repeat the old implementation plan. The goal is to answer: > Is the current infrastructure internally consistent, documented, recoverable, and free of unintended dependencies on the retired architecture? ### Forgejo baseline * [ ] Confirm Forgejo is running on the intended current host. * [ ] Confirm the retired Forgejo instance is no longer an unintended dependency. * [ ] Confirm DNS reflects the current topology. * [ ] Confirm reverse-proxy routing reflects the current topology. * [ ] Confirm current data paths are documented. * [ ] Confirm current service configuration is documented. * [ ] Remove or archive obsolete migration-only configuration. ### Forgejo runners * [ ] Inventory current runners. * [ ] Confirm each runner is registered against the correct Forgejo instance. * [ ] Confirm runner labels. * [ ] Confirm workflows route to the correct runner. * [ ] Confirm runner accounts match the current isolation model. * [ ] Remove obsolete runner registrations. ### Network / routing * [ ] Confirm current WireGuard/internal routing. * [ ] Confirm required service-to-service connectivity. * [ ] Confirm obsolete proxy paths are no longer required. * [ ] Confirm firewall rules match the current architecture. * [ ] Document intentional cross-host dependencies. ### Service ownership / permissions * [ ] Confirm service ownership on each managed host. * [ ] Confirm obsolete shared-account dependencies are either removed or tracked. * [ ] Link remaining service-isolation work to the dedicated security issue. * [ ] Confirm current deployment paths match the intended architecture. ### Forgejo configuration / credentials * [ ] Confirm current organization variables. * [ ] Confirm current repository-scoped deployment configuration. * [ ] Link remaining credential-isolation work to its dedicated issue. * [ ] Confirm retired credentials are no longer required. ### Backup / recovery * [ ] Confirm Forgejo backups cover the current host and data paths. * [ ] Confirm backup retention is appropriate. * [ ] Confirm restoration documentation reflects the current topology. * [ ] Confirm runner/configuration recovery requirements are documented. * [ ] Perform or schedule a recovery validation if the current architecture has not been tested. ### Documentation * [ ] Review infrastructure documentation for obsolete hostnames. * [ ] Review infrastructure documentation for retired service users. * [ ] Remove obsolete deployment patterns presented as current. * [ ] Confirm documentation distinguishes current and bespoke/legacy systems. * [ ] Ensure Wiki guidance points to the current infrastructure model where appropriate. ### Cleanup / closure * [ ] Identify orphaned configuration left from migration. * [ ] Identify obsolete services/files. * [ ] Remove obsolete state only after verifying it is unused. * [ ] Create separate issues for newly discovered substantial work. * [ ] Link all remaining follow-up issues. * [ ] Record a final infrastructure-baseline summary. ### Technical-debt impact Migration remnants become hidden dependencies over time. Without a clear post-migration baseline, future incidents and infrastructure changes require rediscovering which parts of the old architecture are still meaningful. ### Risk / compatibility impact The audit itself is low-risk, but cleanup actions may affect production infrastructure. Potentially destructive or high-risk discoveries should be split into focused issues and reviewed independently. ### Affected branch(es) Not primarily branch-specific. Repository/documentation changes discovered during the audit should use their respective branch workflows. ### Additional context The old infrastructure issue mixed Forgejo migration, runner setup, service accounts, credentials, repository protection, and docs-branch creation in one checklist. This replacement is intentionally a governing closure issue. Focused security and automation work should remain in their dedicated issues. ### Request checklist - [x] I described why this work provides value or avoids future technical debt - [x] I identified known risk, compatibility, or coordination concerns where applicable ### Workflow lifecycle ### Triage - [x] `Kind/` classification confirmed - [x] Issue validity reviewed and appropriate `Reviewed/` label assigned - [x] `Priority/` assigned when appropriate - [x] Implementation branch referenced on the issue through Forgejo when applicable - [ ] Information requirements resolved; no `Status/Needs More Info` remains - [x] `Status/Needs Triage` removed before leaving Triage ### Backlog - [ ] Issue is confirmed valid and accepted into the project backlog ### To Do - [ ] Scope and expected outcome are sufficiently defined - [ ] Known prerequisites, dependencies, and required decisions are resolved or understood - [ ] Work has been deliberately selected as upcoming work ### In Progress - [ ] Assignee or active owner identified when appropriate - [ ] Forgejo timer started when time tracking provides meaningful value - [ ] Relevant implementation, research, or work notes recorded as needed - [ ] Forgejo timer stopped when active work ends, pauses, or becomes blocked ### Review Gate - [ ] Review requirement assessed based on complexity, criticality, reversibility, and impact - [ ] If review is required: moved to **In Review** and appropriate testing / validation performed - [ ] If review is required: review comment records what was reviewed, how it was validated, findings, and outcome - [ ] If review is not required: rationale is evident from the low-risk nature of the change ### Completed - [ ] Acceptance criteria / intended outcome satisfied - [ ] Related PRs, commits, documentation, or external changes linked where applicable - [ ] Resolution is documented by a linked PR that closes the issue, or by a final issue comment explaining what changed, how it was resolved, and how it was verified - [ ] Follow-up work split into separate issues where appropriate - [ ] Any Forgejo timer is stopped and recorded time is final - [ ] Issue moved to **Completed** and closed

Xeplosion added the

Reviewed

Confirmed

Rows
Columns