Files

T

ben.stull 3713299f08 reshape: move OHM transcripts under ohm/ for org-wide multi-app layout; add org-wide root README

2026-06-03 06:54:38 -07:00

10 KiB

Raw Blame History

Session 0051.0 — Transcript

Date: 2026-05-31 Goal: Make every repository on git.wiggleverse.org private, and force future repos private by default.

Outcome: Done. All 20 repos across both owners (ben.stull, wiggleverse) and both orgs (wiggleverse, wiggleverse-org) are now private; FORCE_PRIVATE = true + DEFAULT_PRIVATE = private set in the Gitea app.ini and the container restarted. Verified externally: anonymous repo search returns 0, formerly-public repos 404 to unauthenticated callers. Temp admin tokens minted during the run were revoked.

Highlights:

The Gitea host is a Dockerized gitea/gitea:latest container on the gitea VM in GCP project wiggleverse (not wiggleverse-ohm), reachable only via IAP tunnel (port 22 firewalled).

The rfc-app bot (ohm-bot) is not a site admin and only saw 17 public repos; the authoritative admin enumeration surfaced 20.

Operator decisions (via AskUserQuestion): force future repos private too; every repo, no exceptions.

Launch prompt

(launch prompt not captured at claim time — this session was anchored in ohm-rfc and the operator opened with: "I want to make every repo on git.wiggleverse.org private.")

Pre-session state

Anchored in ~/projects/wiggleverse/ohm-rfc (the OHM content repo).
git.wiggleverse.org = Gitea behind Cloudflare (104.21.x / 172.67.x), GCP origin 34.55.46.221.
All repos public. Inventory at session start (20 total):
- ben.stull/* (user): benstull, ohm-rfc, rfc-app, rfc-app-prototype, wiggleverse-ecomm-prototype (public) + it (already private).
- wiggleverse/* (org): engineering, meta, ohm-content, ohm-rfc-app-flotilla, ohm-session-history, rfc-0001-human, wiggleverse-ecomm, wiggleverse-ecomm-bdd-release-planner-app(+-flotilla,-meta), wiggleverse-ecomm-flotilla, wiggleverse-ecomm-meta (all public).
- wiggleverse-org/* (a second org): corp, it (both already private).
Gitea users: ben.stull (id 1, site admin), rfc-bot (id 3), ohm-bot (id 5). Bots are non-admin.

Turn-by-turn arc

Arc 1 — Access discovery

No tea/gitea CLI locally, no API token on disk. The transcript-publish scripts authenticate purely over SSH (ssh://git@git.wiggleverse.org:2222), so there was no API path lying around. Established the Gitea host runs on a GCP VM reached via gcloud compute ssh. First guess ohm-app/wiggleverse-ohm was wrong; instance enumeration found:

ohm-rfc-app in wiggleverse-ohm — the rfc-app deployment (nginx + bot backend at /opt/ohm-rfc-app/backend), NOT Gitea.
gitea in wiggleverse — the Gitea origin (34.55.46.221).

Direct SSH (port 22) timed out — firewalled. --tunnel-through-iap worked.

Arc 2 — Confirming the bot was insufficient

Read the rfc-app backend .env on ohm-rfc-app: bot is ohm-bot (id 5), is_admin=False. /repos/search with the bot token showed 17 public repos; bot had admin=True only on wiggleverse/*, admin=False on ben.stull/*. So the bot token alone could not flip the user-owned repos → needed a site-admin path on the actual Gitea host.

Arc 3 — Operator decisions

Asked (AskUserQuestion): (1) future repos — force private too; (2) scope — every repo, no exceptions.

Arc 4 — Flipping all repos (the work)

On the gitea VM: Gitea is a Docker container (gitea/gitea:latest), app.ini at /opt/gitea/data/gitea/conf/app.ini, DB = sqlite3 at /data/gitea/gitea.db. Minted a short-lived site-admin token via docker exec -u git gitea gitea admin user generate-access-token --username ben.stull --scopes write:repository,read:repository, write:organization,read:organization,read:admin.

Drove a Python script (/tmp/ohm_make_private.py, piped to sudo python3 -) that: enumerated all repos via admin endpoints (/admin/users, /admin/orgs, per-owner repo lists) + /repos/search cross-check; PATCHed each public repo {"private": true}; re-fetched each to verify.

Two bugs fixed mid-run (honest record):

First token lacked admin scope → /admin/* empty; and /repos/search returns {"data":[...]} not a bare array → TypeError. Fixed by adding read:admin scope and handling both response shapes.
/admin/users items keyed differently than expected → made owner-login extraction defensive (login/username/name) + search fallback.

Result: 20 repos enumerated (3 already private skipped, 17 flipped, all 200). Verify pass: 20/20 private, patched_fail=[], still_not_private=[].

Arc 5 — Force future repos private

Edited app.ini [repository] (with timestamped backup) to add:

DEFAULT_PRIVATE = private
FORCE_PRIVATE = true

docker restart gitea; API healthy again in 2s.

Arc 6 — Cleanup + external verification

Three temp tokens were minted across the debug runs (make-all-private-*, all uid 1). Token-revocation API needs basic auth (no password on hand), so deleted the rows directly: docker exec gitea sqlite3 … "DELETE FROM access_token WHERE name LIKE 'make-all-private-%';". Confirmed only the pre-existing legit tokens remain (wiggleverse-rfc-app, rfc-app-prod, ohm-app, ben-ohm-direct-access, wiggleverse-ecomm-meta).

External proof through the public Cloudflare URL (unauthenticated):

GET /api/v1/repos/search → 0 repos visible anonymously.
wiggleverse/ohm-content, ben.stull/ohm-rfc, wiggleverse/ohm-session-history → all HTTP 404.

Bonus confirmation: the session-claim push to the now-private ohm-session-history succeeded over SSH, proving the operator's key / site-admin access survives the privacy flip.

Cut state (end of session)


Gitea host	`gitea` VM, GCP project `wiggleverse`, us-central1-a, container `gitea/gitea:latest`
Repos	20/20 private (all owners + both orgs)
`app.ini`	`[repository] DEFAULT_PRIVATE = private`, `FORCE_PRIVATE = true`; backup `app.ini.bak-<ts>` alongside
Gitea service	restarted, API healthy
Temp tokens	minted + revoked (DB delete); only pre-existing tokens remain
ohm-rfc / rfc-app	untouched (no code change — pure infra op)

This session's ledger	Status
Make every repo private	✅ done (20/20)
Force future repos private	✅ done (`FORCE_PRIVATE=true`)
Revoke temp admin tokens	✅ done
External verification	✅ done (anon search 0, 404s)

§19.2 candidates surfaced

No admin API token in the operator toolkit. Every admin op required SSH-into-the-VM + docker exec to mint a throwaway token. A long-lived, narrowly-scoped, named admin token stored as an operator secret (and a tea/gitea CLI config) would make future bulk repo ops one command instead of a VM round-trip. Tracked-able as ops tooling.
Token revocation has no clean CLI path. Gitea offers no gitea admin user revoke-access-token; revocation went through a raw sqlite DELETE. Fine for a closed instance, but worth a small wrapper script in ohm-infra/scripts/ so it's not ad-hoc next time.
Host topology is non-obvious. The Gitea origin lives in project wiggleverse, while OHM's app lives in wiggleverse-ohm; the first SSH guess was wrong. An ohm-infra host/inventory note (VM ↔ project ↔ role ↔ IAP-only) would save the discovery dance.

What lands on the operator's plate

Decide whether ohm-bot needs collaborator access to any ben.stull/* repo. The bot is admin on all wiggleverse/* repos (app access intact), but is NOT a collaborator on the now-private ben.stull/* repos — it only saw them before because they were public. If any deployment path pulls ben.stull/ohm-rfc (or another ben.stull/* repo) through the bot, that read now 404s. Most OHM content is served from wiggleverse/ohm-content and PHILOSOPHY_PATH points at a local clone, so this is likely fine — but watch for it. Fix if needed: add ohm-bot as a read collaborator on the specific repo.
ohm-session-history is now private. Transcript claim/publish still works (SSH key has access), but the public "build in the open" surface at git.wiggleverse.org is no longer anonymously readable, and rfc-app's on-site /docs/sessions browser (if it reads via anonymous Gitea) may now fail to load transcripts. If the public sessions browser matters, either revert that one repo to public or have rfc-app read it via the authenticated bot. (Not actioned — "every repo, no exceptions" was explicit.)
FORCE_PRIVATE=true is global. No new repo on the instance can be made public via the UI/API while this is set. If a future repo must be public, the operator flips FORCE_PRIVATE=false (or removes it) and restarts.

Prompt the operator can paste into the next Claude Code session

You are an OHM driver session; reserve your own session ID via
~/git/ohm-infra/scripts/claim-session-id.sh (don't trust any number in
this prompt). Read ~/git/ohm-infra/SESSION-PROTOCOL.md once.

Context from Session 0051: every repo on git.wiggleverse.org was made
private and FORCE_PRIVATE=true was set in the Gitea app.ini (Dockerized
gitea on the `gitea` VM in GCP project `wiggleverse`, IAP-only SSH).
All 20 repos verified private; anonymous access returns 404.

Open items you may need to act on:
  1. ohm-bot is NOT a collaborator on the now-private ben.stull/* repos
     (it had only public visibility before). If any deployment reads a
     ben.stull/* repo through the bot, it now 404s — add ohm-bot as a read
     collaborator on that specific repo if something breaks.
  2. ohm-session-history is now private — if rfc-app's /docs/sessions
     browser reads it anonymously, it may have stopped loading. Decide:
     make that one repo public again, or switch rfc-app to authenticated
     reads.
  3. FORCE_PRIVATE is global now; any intentionally-public future repo
     needs that flag relaxed + a restart.

Consider filing the §19.2 candidates from 0051 (named admin token + tea
CLI config; a revoke-token wrapper script; an ohm-infra host inventory
note) if you want the next bulk Gitea op to not require a VM round-trip.

10 KiB Raw Blame History