nimmo/nixos-config
nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 15 Pull requests Wiki Activity Actions

Configure Paseo Forgejo PR integration with Tea #71

Merged
nimmo merged 2 commits from feat/paseo-forgejo-tea into main 2026-07-19 00:10:38 +01:00
Conversation 1 Commits 2 Files changed 4 +57 -3
nimmo commented 2026-07-19 00:00:54 +01:00
Owner
Copy link

Summary

  • install pkgs.tea through the shared AI/Paseo profile
  • render Tea's git.nimmog.uk login from a dedicated forgejo/paseo/token SOPS secret with user-only permissions
  • keep the existing Vega Forgejo MCP bot token separate and document required token scopes

Closes #70.

Validation

  • nixfmt modules/profiles/ai-desktop.nix
  • nix flake check
  • live test deployment on Electra: user successfully created a Forgejo PR through Paseo

Deployment note

forgejo/paseo/token is committed as an encrypted SOPS secret. It is repository-restricted with write:repository and read:issue; add write:issue only when Paseo should write PR comments.

## Summary - install `pkgs.tea` through the shared AI/Paseo profile - render Tea's `git.nimmog.uk` login from a dedicated `forgejo/paseo/token` SOPS secret with user-only permissions - keep the existing Vega Forgejo MCP bot token separate and document required token scopes Closes #70. ## Validation - `nixfmt modules/profiles/ai-desktop.nix` - `nix flake check` - live test deployment on Electra: user successfully created a Forgejo PR through Paseo ## Deployment note `forgejo/paseo/token` is committed as an encrypted SOPS secret. It is repository-restricted with `write:repository` and `read:issue`; add `write:issue` only when Paseo should write PR comments.
feat(paseo): configure Tea Forgejo login
All checks were successful
Build and Push Attic Cache / test (pull_request) Successful in 33s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
bbde4381d6
chore(secrets): add Paseo Forgejo token
All checks were successful
Build and Push Attic Cache / test (pull_request) Successful in 34s
Details
Build and Push Attic Cache / build (pull_request) Has been skipped
Details
0409a54e54
nimmo merged commit 205d1960ec into main 2026-07-19 00:10:38 +01:00
nimmo deleted branch feat/paseo-forgejo-tea 2026-07-19 00:11:01 +01:00
nimmo commented 2026-07-19 00:11:12 +01:00
Author
Owner
Copy link

Live validation

User-confirmed on 2026-07-19: after test deployment and restarting Paseo, creating a pull request through Paseo succeeded. This validates Tea availability, the SOPS-rendered Forgejo login, HTTPS reachability, and Paseo's Forgejo PR-creation flow end to end.

## Live validation User-confirmed on 2026-07-19: after test deployment and restarting Paseo, creating a pull request through Paseo succeeded. This validates Tea availability, the SOPS-rendered Forgejo login, HTTPS reachability, and Paseo's Forgejo PR-creation flow end to end.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
area:authentication
Issues related to authentication area

  
area:flake-utilities
Issues related to flake utilities area

  
area:performance
Issues related to performance area

  
area:tbd
Area to be determined

  
host:chaos
Issues specific to the chaos host.

  
host:electra
Issues specific to the electra host.

  
host:fleet
Issues that span multiple hosts or the fleet as a whole.

  
host:lyra
Issues specific to the lyra host.

  
host:nova
Issues specific to the nova host.

  
host:vega
Issues specific to the vega host.

  
investigation
Issue is an investigation task

  
phase:cutover
The service cutover execution phase.

  
phase:deploy

   
phase:mcp

   
phase:module

   
phase:packaging

   
phase:prep
Preparation and preflight work before service cutover.

  
phase:validation
Post-cutover validation and rollback-window work.

  
priority:high
High priority issue

  
priority:medium
Medium priority issue

  
project:attic-postgres-lyra-rollout
Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

  
project:auto-update-reliability
Work arising from the automated update reliability review.

  
project:auto-update-remediation
Guarded Nova-assisted diagnosis and remediation of failed automated updates.

  
project:declarative-purity-cleanup
Issues in the declarative purity cleanup workstream.

  
project:external-review
Review of external configurations for ideas and improvements

  
project:fleet-boundary-cleanup
Maintainability work that clarifies fleet configuration and automation boundaries.

  
project:host-facts-refactor
Issues in the host facts refactor workstream.

  
project:lyra-nixos-deploy
Issues in the Lyra NixOS deployment workstream.

  
project:lyra-service-stack-migration
Issues in the lyra service stack migration workstream.

  
project:nebula-mesh-network
Issues in the Nebula mesh network workstream.

  
project:nixos-build-deployment-pipeline
Issues in the NixOS Build & Deployment Pipeline workstream.

  
project:security-hardening
Work belonging to the Security Hardening milestone

  
project:service-stack-migration
Issues in the service stack migration workstream.

  
project:vega-sillytavern-cutover
Issues in the Vega SillyTavern cutover workstream.

  
project:wiki-rebuild
Re-found the repository wiki as the fleet's curated knowledge architecture.

  
repo:numtide/flake-utils
Issues related to numtide/flake-utils repository

  
repo:numtide/nix-auth
Issues related to numtide/nix-auth repository

  
repo:numtide/nixos-passthru-cache
Issues related to numtide/nixos-passthru-cache repository

  
repo:numtide/nix-relay
Issues related to numtide/nix-relay repository

  
service:auto-update
NixOS flake update, cache build, and consumer deployment automation.

  
service:mem0

   
service:nix
Issues concerning Nix build, store, cache, or deployment infrastructure.

  
service:sillytavern
Issues related to the SillyTavern service.

  
service:slskd
Soulseek daemon (slskd) work.

  
service:synthseek
Synthseek music discovery/library manager work.

No labels
area:authentication
area:flake-utilities
area:performance
area:tbd
host:chaos
host:electra
host:fleet
host:lyra
host:nova
host:vega
investigation
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
priority:high
priority:medium
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:auto-update-remediation
project:declarative-purity-cleanup
project:external-review
project:fleet-boundary-cleanup
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:nixos-build-deployment-pipeline
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
project:wiki-rebuild
repo:numtide/flake-utils
repo:numtide/nix-auth
repo:numtide/nixos-passthru-cache
repo:numtide/nix-relay
service:auto-update
service:mem0
service:nix
service:sillytavern
service:slskd
service:synthseek
Milestone
Clear milestone
No items
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/nixos-config!71
No description provided.