EXTENSIONS

Careful administration of a Forgejo (or Gitea) server over its /api/v1 REST API, authenticated with a scoped access token. Find-or-create organizations and repositories and converge their settings, run GitHub pull-mirrors (create via /repos/migrate, reconcile interval/visibility, queue immediate syncs), audit every mirror's sync health, drive pull requests (open, inspect with mergeability and head CI state, merge), and audit or repoint repository webhooks so a stale CI target is visible rather than silently undelivered. Mutations are find-or-create or reversible (archive/unarchive) apart from the guarded pr_merge; there are no delete methods — a failed migration's empty shell repo is detected and reported, never auto-deleted. Secrets are never emitted: mirror source credentials are write-only, and webhook operations neither read nor write the shared hook secret.

Provision a Craft-ready Hetzner server — nginx, PHP-FPM, MySQL, vhost, database, optional TLS and Tailscale — with a protected teardown. Deployment is intentionally out of scope.

Drive an existing Ansible playbook from swamp. `check` runs --check --diff and never mutates, so changed=0 across every host is a machine-readable 'already matches its declaration' gate; `apply` runs for real. Parses the PLAY RECAP into typed per-host tallies for CEL, accepts inventory as content so a workflow can build it from model data instead of a render script, and keeps vault and sudo passwords in 0600 temp files rather than argv.

Laravel Forge (API v2, org-scoped) — list servers, audit and idempotently provision sites (git-backed or repo-less, e.g. a reverse proxy to a Node app), set a site's .env from a vault reference, read and replace a site's nginx config, run root-level Bash on a server via Forge recipes, install LetsEncrypt SSL, and manage deployments (set deploy script, deploy with polling, read the deploy log).

Generic cloud-init NoCloud seed ISO generator for Swamp. Renders user-data, meta-data, and optional network-config into an ISO 9660 image with CIDATA volume label, optionally writing the ISO to a host filesystem path.