removed non-working secrets management of pulumi.dev.yaml

.env.local

@@ -0,0 +1,3 @@
+GITEA_API_URL=https://gitea.kasuns.website/kasun/homelab-infrastructure-as-code.git
+GITEA_TOKEN=ba3fd0f4851aa627e2088da1f94a596646ba2de7
+

.env.local.example

@@ -1,10 +0,0 @@
-# Copy this file to .env.local and fill in your values.
-# .env.local is gitignored and never committed.
-
-# Gitea HTTP API base URL for this repo (no trailing slash)
-# Example: http://192.168.1.208:3000/api/v1/repos/kasun/homelab-infrastructure-as-code
-GITEA_API_URL=http://<your-gitea-host>/api/v1/repos/<owner>/<repo>
-
-# Gitea personal access token with read/write Actions Secrets permission
-# Generate at: Gitea → Settings → Applications → Access Tokens
-GITEA_TOKEN=<your-gitea-token>

.gitea/workflows/deploy-proxmox-infra.yaml

@@ -29,9 +29,6 @@ jobs:
         with:
           node-version: '24'
 
-      - name: Restore Stack Config
-        run: echo "${{ secrets.PULUMI_DEV_YAML }}" | base64 -d > proxmox-infra/Pulumi.dev.yaml
-
       - name: Install Dependencies
         run: npm install
         working-directory: proxmox-infra
@@ -59,9 +56,6 @@ jobs:
         with:
           node-version: '24'
 
-      - name: Restore Stack Config
-        run: echo "${{ secrets.PULUMI_DEV_YAML }}" | base64 -d > proxmox-infra/Pulumi.dev.yaml
-
       - name: Install Dependencies
         run: npm install
         working-directory: proxmox-infra

.githooks/pre-push

@@ -1,36 +0,0 @@
-#!/bin/bash
-set -e
-
-YAML_FILE="proxmox-infra/Pulumi.dev.yaml"
-
-# Load local env if present
-if [ -f .env.local ]; then
-  export $(grep -v '^#' .env.local | xargs)
-fi
-
-if [ ! -f "$YAML_FILE" ]; then
-  echo "[pre-push] $YAML_FILE not found — skipping Gitea secret sync"
-  exit 0
-fi
-
-if [ -z "$GITEA_API_URL" ] || [ -z "$GITEA_TOKEN" ]; then
-  echo "[pre-push] GITEA_API_URL or GITEA_TOKEN not set — skipping Gitea secret sync"
-  echo "[pre-push] Add these to .env.local to enable automatic sync"
-  exit 0
-fi
-
-ENCODED=$(base64 -w 0 "$YAML_FILE")
-
-HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X PUT \
-  -H "Authorization: token $GITEA_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d "{\"data\": \"$ENCODED\"}" \
-  "$GITEA_API_URL/actions/secrets/PULUMI_DEV_YAML")
-
-if [ "$HTTP_STATUS" = "201" ] || [ "$HTTP_STATUS" = "204" ]; then
-  echo "[pre-push] Gitea secret PULUMI_DEV_YAML updated"
-else
-  echo "[pre-push] Failed to update Gitea secret (HTTP $HTTP_STATUS)"
-  echo "[pre-push] Check GITEA_API_URL and GITEA_TOKEN in .env.local"
-  exit 1
-fi

.gitignore

@@ -3,5 +3,4 @@
 .vscode
 node_modules/
 bin/
-Pulumi.dev.yaml
-.env.local
+Pulumi.dev.yaml

proxmox-infra/CLAUDE.md

@@ -51,7 +51,7 @@ Secrets required in Gitea (`Settings → Actions → Secrets`):
 
 - `PULUMI_BACKEND_URL` — PostgreSQL connection string for the self-hosted state backend
 - `PULUMI_CONFIG_PASSPHRASE` — passphrase used to decrypt secrets in `Pulumi.dev.yaml`
-- `PULUMI_DEV_YAML` — base64-encoded content of `Pulumi.dev.yaml` (auto-synced by pre-push hook)
+- `PULUMI_DEV_YAML` — base64-encoded content of `Pulumi.dev.yaml`; update manually whenever the file changes: `base64 -w 0 Pulumi.dev.yaml`
 
 ## Key Notes