Switch the factory iac and postgres OpenTofu workflows from runs-on: ubuntu-latest to runs-on: ubuntu-latest-ca (both the gitea_vault_auth and tofu jobs in each file).
Why
Since the move to the self-signed internal DNS (gitea.arcodange.lab / vault.arcodange.lab), the default ubuntu-latest runner image does not trust the homelab CA. The first thing each job does is uses: https://gitea.arcodange.lab/arcodange-org/vault-action.git@main, which clones the action over HTTPS and fails x509 verification on the self-signed cert — so the workflow never reaches terraform apply.
The ubuntu-latest-ca runner image ships the homelab CA in its trust store. The webapp repo's vault.yaml already moved to it; this just applies the same fix to the two factory workflows that were missed.
Changes
.gitea/workflows/iac.yaml — both jobs → ubuntu-latest-ca
.gitea/workflows/postgres.yaml — both jobs → ubuntu-latest-ca
No logic change beyond the runner label.
Note: this unblocks the clone/TLS failure. The OVH/Cloudflare admin credentials in kvv1/admin/** (lost in the earlier Vault incident, since regenerated) still need to be verified against what the providers expect — tracked separately, not in this PR.
## What
Switch the factory **`iac`** and **`postgres`** OpenTofu workflows from `runs-on: ubuntu-latest` to `runs-on: ubuntu-latest-ca` (both the `gitea_vault_auth` and `tofu` jobs in each file).
## Why
Since the move to the self-signed internal DNS (`gitea.arcodange.lab` / `vault.arcodange.lab`), the default `ubuntu-latest` runner image does **not** trust the homelab CA. The first thing each job does is `uses: https://gitea.arcodange.lab/arcodange-org/vault-action.git@main`, which clones the action over HTTPS and fails x509 verification on the self-signed cert — so the workflow never reaches `terraform apply`.
The `ubuntu-latest-ca` runner image ships the homelab CA in its trust store. The **webapp** repo's `vault.yaml` already moved to it; this just applies the same fix to the two factory workflows that were missed.
## Changes
- `.gitea/workflows/iac.yaml` — both jobs → `ubuntu-latest-ca`
- `.gitea/workflows/postgres.yaml` — both jobs → `ubuntu-latest-ca`
No logic change beyond the runner label.
> Note: this unblocks the *clone/TLS* failure. The OVH/Cloudflare admin credentials in `kvv1/admin/**` (lost in the earlier Vault incident, since regenerated) still need to be verified against what the providers expect — tracked separately, not in this PR.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
After the move to the self-signed internal DNS (gitea.arcodange.lab /
vault.arcodange.lab), the default `ubuntu-latest` runner image does not
trust the homelab CA, so the `uses:` clone of the vault-action over HTTPS
fails TLS verification. webapp's workflows already moved to the
`ubuntu-latest-ca` runner (whose image ships the homelab CA); apply the
same to the factory `iac` and `postgres` tofu workflows.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
Switch the factory
iacandpostgresOpenTofu workflows fromruns-on: ubuntu-latesttoruns-on: ubuntu-latest-ca(both thegitea_vault_authandtofujobs in each file).Why
Since the move to the self-signed internal DNS (
gitea.arcodange.lab/vault.arcodange.lab), the defaultubuntu-latestrunner image does not trust the homelab CA. The first thing each job does isuses: https://gitea.arcodange.lab/arcodange-org/vault-action.git@main, which clones the action over HTTPS and fails x509 verification on the self-signed cert — so the workflow never reachesterraform apply.The
ubuntu-latest-carunner image ships the homelab CA in its trust store. The webapp repo'svault.yamlalready moved to it; this just applies the same fix to the two factory workflows that were missed.Changes
.gitea/workflows/iac.yaml— both jobs →ubuntu-latest-ca.gitea/workflows/postgres.yaml— both jobs →ubuntu-latest-caNo logic change beyond the runner label.
🤖 Generated with Claude Code