Register Gitea webhook 14 for oikos-console deploy

Created via the Gitea API (POST /repos/dtoro/Homelab-Docs/hooks) rather
than the UI, since the existing PAT turned out to have sufficient scope.
Webhook id 14: http://192.168.8.205:9831/deploy, push events, main branch
filter, active.

The shared secret was generated and registered with Gitea before the
apps-side bootstrap ran (order reversed from the usual install.sh-first
flow, since direct SSH deploy to apps is still pending operator
execution — see oikos/console/deploy/README.md). Stored as
secrets/oikos-console-deploy-secret.yaml (SOPS, recipient: apps only)
rather than left as a local plaintext file, with explicit operator
sign-off. When the apps-side install runs, skip webhook/install.sh's
random-secret generation and write this exact value into
/etc/oikos-console-deploy/secret instead.

infrastructure/auto-deploy.md updated with the real webhook id (was
"not yet registered").

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.sops.yaml

@@ -123,4 +123,14 @@ creation_rules:
     age: >-
       age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
       age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
+
+  - path_regex: ^secrets/oikos-console-deploy-secret\.yaml$
+    # Shared HMAC secret for the Gitea deploy webhook (id 14) ->
+    # oikos-console-deploy.service on apps (105). Generated + registered
+    # with Gitea before the apps-side install ran (see
+    # oikos/console/deploy/README.md "Status") — write this exact value
+    # into /etc/oikos-console-deploy/secret rather than letting
+    # webhook/install.sh generate a fresh one.
+    age: >-
+      age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 # webhook noop 2026-05-20T18:16:57+02:00

infrastructure/auto-deploy.md

@@ -44,7 +44,7 @@ The app repo at `/opt/<thing>` is the working tree, but the deploy tooling (`web
 | `dtoro/Homelab-Docs` → homelab-mcp | [apps (105)](../containers/105-apps.md) `/opt/homelab-mcp/` | B | `http://192.168.8.205:9811/deploy` | 10 | reinstalls `homelab-mcp.service` + restart |
 | `dtoro/Homelab-Docs` → secrets-issuance | [apps (105)](../containers/105-apps.md) `/opt/secrets-issuance/` | B | `http://192.168.8.205:9821/deploy` | 11 | reinstalls `secrets-issuance.service` + restart |
 | `dtoro/terminalito`             | [trmnl (128)](../containers/128-trmnl.md) `/opt/terminalito/` | B | `http://192.168.8.211:9797/deploy` | 12 | reinstalls units + `systemctl restart trmnl-plugins` |
-| `dtoro/Homelab-Docs` → oikos-console | [apps (105)](../containers/105-apps.md) `/opt/oikos-console/` | B | `http://192.168.8.205:9831/deploy` | (not yet registered) | reinstalls `oikos-console.service` + restart — see [oikos/console/deploy/README.md](../oikos/console/deploy/README.md) |
+| `dtoro/Homelab-Docs` → oikos-console | [apps (105)](../containers/105-apps.md) `/opt/oikos-console/` | B | `http://192.168.8.205:9831/deploy` | 14 | reinstalls `oikos-console.service` + restart — see [oikos/console/deploy/README.md](../oikos/console/deploy/README.md) |
 
 > Note: `dtoro/Homelab-Docs` has **three webhooks** firing on the same push.
 > Each owns its own clone on LXC 105. They don't conflict because each

ledger/2026-07.jsonl

@@ -1 +1,2 @@
 {"ts": "2026-07-06T11:05:35+00:00", "agent": "mac-mini", "entity": "host:teddycloud", "action": "activate", "risk": "config_mutation", "verification": "homelab node teddycloud relations", "result": "ok"}
+{"ts": "2026-07-06T11:15:04+00:00", "agent": "mac-mini", "entity": "repo:Homelab-Docs", "action": "register-webhook", "risk": "config_mutation", "result": "ok", "notes": "webhook id 14 for oikos-console deploy"}

oikos/console/deploy/README.md

@@ -8,33 +8,48 @@ for the general pattern; webhook ids 10 (homelab-mcp, :9811) and 11
 (secrets-issuance, :9821) are the direct precedent — this is a third
 webhook on `dtoro/Homelab-Docs`, port :9831.
 
+## Status (2026-07-06)
+
+- **Gitea webhook: done.** Registered via the Gitea API as webhook id
+  **14** (`http://192.168.8.205:9831/deploy`, `push` events, `main`
+  branch filter, active). See
+  [infrastructure/auto-deploy.md](../../../infrastructure/auto-deploy.md).
+- **Console deploy on apps (105): not yet done.** Direct SSH bootstrap
+  was withheld pending explicit operator execution — see "One-time
+  setup" below. **Important:** webhook 14's secret was generated and
+  registered with Gitea *before* the apps-side install (order reversed
+  from the usual flow). It's encrypted at `secrets/oikos-console-deploy-secret.yaml`
+  (recipient: apps only). When you run `webhook/install.sh` below,
+  **skip its random-secret generation** — instead run
+  `homelab secret oikos-console-deploy-secret` on apps and write the
+  `webhook_secret` value into `/etc/oikos-console-deploy/secret` yourself.
+- **Caddy route: not yet done.**
+- **DNS entry: not yet done.**
+
 ## One-time setup on apps (105)
 
 ```bash
 git clone https://git.hubris.network/dtoro/Homelab-Docs.git /opt/oikos-console
 cd /opt/oikos-console
 ./oikos/console/deploy/deploy.sh                 # first install
-./oikos/console/deploy/webhook/install.sh        # generates the deploy secret, prints it
+./oikos/console/deploy/webhook/install.sh        # generates a NEW secret by default —
+                                                  # see "Status" above before running this
 systemctl enable --now oikos-console.service oikos-console-deploy.service
 ```
 
-Then register the Gitea webhook (`dtoro/Homelab-Docs` → Settings →
-Webhooks) with the URL/secret `install.sh` printed, same as webhooks 10/11.
-
 ## Caddy route — NOT in this repo, needs manual addition to `dtoro/caddy-conf`
 
-The console binds `127.0.0.1:8091` only (see `oikos-console.service` —
+The console binds `127.0.0.1:8091` on apps only (see `oikos-console.service` —
-`ProtectSystem=strict`, no LAN listener). Caddy on LXC 121 needs a new
+`ProtectSystem=strict`, no LAN listener); Caddy on LXC 121 reaches it via
-site block proxying to it, forward-auth gated the same way
+apps' **LAN IP**, not loopback (they're different hosts). Site block,
-`paperless`/other LAN-only services are (via the shared `(authentik)`
+forward-auth gated the same way other LAN-only services are (confirmed
-snippet referenced in
+syntax per `containers/121-caddy.md`: `import authentik`, no parens in
-[containers/106-auth-outpost.md](../../../containers/106-auth-outpost.md)).
+the import statement itself — the snippet is *defined* as `(authentik)`
-Confirm the exact snippet name/import syntax against the live
+but *imported* as `authentik`):
-`dtoro/caddy-conf` repo — this is the shape, not verified against it:
 
 ```caddyfile
 oikos.hubris.network {
-    import (authentik)
+    import authentik
     reverse_proxy 192.168.8.205:8091
 }
 ```

secrets/oikos-console-deploy-secret.yaml

@@ -0,0 +1,16 @@
+webhook_secret: ENC[AES256_GCM,data:xo9I443vTtLvQesuyEOmfduLbljaVSQeWf6B7d9Vjp6HoP92BJiogsrPXQ==,iv:HI6Q7OzS0dNjJVXfmxNbetjxOE5nAWQoaXSki0fiItE=,tag:bfnR5RmVmVd0ahRXIRV1yg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHdzl3Z0dwU09aWjVBcHcx
+            ZE4rWHJ0aXhueXZmZ2NhSWlSaHdzUnRYR3hZClRVZVY4WDBTOHFnM251L2M5R1dp
+            T0ZQWmQrK09Uck5laksrVTZuckRqVU0KLS0tIGxKZ2ZUa09jdklWT2JPWW1KTVZr
+            cGFiZHk3YWtxLzFCS011cHpjdE1JTXMKCJXHZn7akExja+Xy9SeHjFoc1h/ctuQP
+            s1CUPsnZXPwOkxWSyqx+YEeilxwWlGgmWT4EZXAz/JcSRPyq8u+flg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
+    lastmodified: "2026-07-06T11:14:22Z"
+    mac: ENC[AES256_GCM,data:J4KRkno5xwfs1za0PqGR7MKSuve9tTv5zBIb02nvD+pXTBuW5CzhnQM4YPTtq8NhSngEGJbVA0o5iK5aG3ezXFyG/m3JzACooN/3XHh3zvEvm/ZuubiV+mVhJYNv/+3/nK+jCeIJNrpmw8opAEE2+sy2cKryNUV1jRlw1GGFE2k=,iv:7PDWchlXYpDde3WsBiZ7UbO+XtMfeqPQO6JDf+/QXLU=,tag:HhfSVbDqtU31I5qLG/dMMQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1