key-store/key.store
15
0
Fork 0
Code Pull requests 18 Releases 180 Activity Actions 5

forge-blob: create missing mirror buckets; four Garage buckets never reached Hetzner #62

Merged
founder merged 1 commit from forge-blob/ensure-mirror-buckets into main 2026-08-16 11:49:09 +00:00
Conversation 0 Commits 1 Files changed 1 +27
founder commented 2026-08-16 11:49:04 +00:00
Owner
Copy link

Surfaced by #36 removing the designed exit 1: Hetzner never had key-store-{forge,mail,mirrors,opentofu-state} (rclone remotes use no_check_bucket, so nothing auto-created them) -- the OpenTofu state was not mirrored at all. ensure_bucket() via a hetzner-admin remote before each copy. Live-tested on the forge: buckets created, identity/identity.tfstate mirrored, run exits 0 with the single-mirror warning.

Surfaced by #36 removing the designed exit 1: Hetzner never had key-store-{forge,mail,mirrors,opentofu-state} (rclone remotes use no_check_bucket, so nothing auto-created them) -- the OpenTofu state was not mirrored at all. ensure_bucket() via a hetzner-admin remote before each copy. Live-tested on the forge: buckets created, identity/identity.tfstate mirrored, run exits 0 with the single-mirror warning.
forge-blob: create missing mirror buckets; four Garage buckets never reached Hetzner
Some checks failed
Deploy: API / Deploy (API) (push) Has been cancelled
Details
Release: If Needed / Check (Release Needed) (push) Has been cancelled
Details
Deploy: Web / Deploy (Web) (push) Has been cancelled
Details
51eb19e3e5
 
With the designed exit 1 for the missing GCS leg gone (#36), the first
mirror run surfaced rclone's own error: PutObject NoSuchBucket for
key-store-opentofu-state on Hetzner. Hetzner had never been given
key-store-{forge,mail,mirrors,opentofu-state} -- the remotes use
no_check_bucket, so rclone never auto-creates a destination bucket, and a
bucket added to the Garage allowlist stayed unmirrored (the OpenTofu state
among them, "the one artifact that must survive losing the forge").

Add a hetzner-admin remote (same endpoint, no no_check_bucket) and
ensure_bucket() -> `rclone mkdir hetzner-admin:<bucket>` before each copy;
mkdir on the no_check_bucket remote is a silent no-op. Live-tested on the
forge: the four buckets now exist on Hetzner and identity/identity.tfstate
is mirrored; the run exits 0 with the single-mirror warning.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
founder deleted branch forge-blob/ensure-mirror-buckets 2026-08-16 11:49:09 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
web
assistant
android
forge
cdo
billing
agent
windows
release-runner
manager
cmo
infra
runner
devex
linux
ios
security-agent
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
key-store/key.store!62
No description provided.