Talos on Simon Shine

OIDC kubeconfigs with Zitadel

Sun, 08 Nov 2026 00:07:52 +0100

Kubeconfig that outlive the persons holding it are a compliance anti-pattern.

Zitadel can be the issuer instead: kubectl opens a browser, gets a short-lived token, and the API server maps a project role to a Kubernetes group.

(Zitadel is a modern replacement for Keycloak. You can use Keycloak for all of this, too.)

From a fresh cluster:

vendor and deploy Zitadel,
create one project role,
point kubectl at the OIDC app.

Vendor and deploy Zitadel ¶

Vendor the Zitadel chart using the helm-vendor CLI:

Evaluating the Kubernetes-native Forgejo CI runners

Sun, 25 Oct 2026 13:19:41 +0100

Until 9 October, CI for my Forgejo ran in docker-in-docker: forgejo-runner 6.3.1 with a privileged docker:29.3.1-dind sidecar, three replicas. Since then every job runs as a Kubernetes Job, through the execution-backend protocol that forgejo-runner v13.1.0 added on 31 August.

A few people have asked what that is like to run for real. Two weeks and 54 tasks in, this is what I know. The Forgejo side of the same cluster is in Running Forgejo on a Hetzner Kubernetes cluster.

Running Forgejo on a Hetzner Kubernetes cluster

Sun, 25 Oct 2026 13:00:29 +0100

I host my own git. Since May 2026 that has been a single Forgejo pod on a Talos cluster at Hetzner, deployed from Nix with kubenix and the upstream forgejo-helm chart.

The first deploy was Forgejo 14.0.4 on chart 16.2.2, SQLite, and a 20Gi volume. Five months later it runs on Postgres, has been knocked over by crawlers three times. Most of what changed in the deployment came from those outages.

tl;dr ¶

The chart is vendored and pinned in charts.toml; kubenix renders it with chart2json, so the Helm values are a Nix attrset and nix build .#test asserts on the output.
No OAuth client secret is in git. A Job generates it into Vault, and VSO renders it back.
A runner that registers on every pod start from an emptyDir leaves three offline rows per rollout. I have 29 of them.
A crawler walking every ref of one repository in every archive format put 16.2G of tarballs on a 20Gi volume. Source archives are now off.
A crawler on blame, commit, commits and src pages took the Actions API down, and three release runs were recorded as failures while their steps passed. An Envoy Gateway rate limit of 60 a minute on those paths fixed it.
Hetzner volumes only grow. Going from 40Gi to 10Gi was a new claim, a tar pipe, and a sha256 over all 3638 files.

The chart is a directory ¶

The chart is vendored with helm-vendor, a small CLI of mine that keeps a registry in charts.toml and unpacks each chart into charts/. Forgejo publishes its chart only as an OCI artifact:

Managing Secrets privately with sops-nix

Fri, 15 May 2026 02:37:41 +0200

tl;dr ¶

I want to commit my secrets encrypted to git with sops-nix
I want to publish my infra-as-code, but don’t want to publish my git secrets
So I put my secrets in a private git+file flake input

Motivation ¶

I run Kubernetes clusters managed declaratively with Talos Linux and kubenix. I want to publish the entire repository that defines the cluster. It includes commands that require authentication (kubectl, talosctl, hcloud, etc.) that don’t work without their secrets.

NixOS runners on Forgejo Actions

Thu, 23 Apr 2026 22:06:40 +0200

Note: You can see the project in action here: https://git.shine.town/infra/runners

I decided to bootstrap a Kubernetes cluster with Talos and kubenix during my vacation.

A lot of experience came out of that, and I’m trying to unpack it gradually.

One of the things I host on this cluster is Forgejo, which is Codeberg’s fork of Gitea. Forgejo has Forgejo Actions which is a CI system that mimicks GitHub Actions, and it has a Container Registry much like GHCR, or DockerHub.