Merge pull request '🔧 Renovate: Update (patch) Terraform signoz to v0.0.13' (#39) from renovate/terraform-signoz-0-0-13 into main

Merged by Trez.One

.gitea/workflows/cloudflare-auto-pr-tofu-pipeline.yml

@@ -0,0 +1,328 @@
+name: Auto-PR Check/Creation and TF/OpenTofu Plan
+
+on:
+  workflow_dispatch:
+  push:
+    branches-ignore:
+      - "main"
+      - "renovate/**"
+    paths:
+      - "cloudflare/**"
+
+env:
+  OPENTOFU_VERSION: "1.10.6"
+  HC_VAULT_VERSION: "1.20.4"
+  TEA_VERSION: "0.10.1"
+
+jobs:
+  check-and-create-pr:
+    name: Check and Create PR
+    outputs:
+      pr_number: ${{ steps.pr-check-create.outputs.pr_number }}
+      pr_url: ${{ steps.pr-check-create.outputs.pr_url }}
+      pr_comments_url: ${{ steps.pr-check-create.outputs.pr_comments_url }}
+      pr_comment_id: ${{ steps.pr-check-create.outputs.pr_comment_id }}
+      pr_comment_uri: ${{ steps.pr-check-create.outputs.pr_comment_uri }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Setting Vault Token
+        run: echo "VAULT_TOKEN=${{ secrets.VAULT_GITEA_TOKEN }}" >> $GITHUB_ENV
+
+      - name: Gotify Notification - Start
+        uses: eikendev/gotify-action@0.0.3
+        with:
+          gotify_api_base: ${{ secrets.RUNNER_GOTIFY_URL }}
+          gotify_app_token: ${{ secrets.RUNNER_GOTIFY_TOKEN }}
+          notification_title: "GITEA: PR Check @ Rinoa"
+          notification_message: "Checking for existing PR... 🔍"
+
+      - name: PR Check/Creation
+        id: pr-check-create
+        uses: https://git.trez.wtf/Trez/gitea-auto-pr@main
+        with:
+          url: ${{ secrets.TREZ_GITEA_URL }}
+          token: ${{ secrets.BOT_GITEA_TOKEN }}
+          pr-label: "opentofu,manual"
+          assignee: ${{ github.actor }}
+
+      - name: Gotify Notification - Done
+        uses: eikendev/gotify-action@0.0.3
+        with:
+          gotify_api_base: ${{ secrets.RUNNER_GOTIFY_URL }}
+          gotify_app_token: ${{ secrets.RUNNER_GOTIFY_TOKEN }}
+          notification_title: "GITEA: PR Check @ Rinoa"
+          notification_message: "PR Check done 🎟️"
+
+  plan-approval:
+    name: OpenTofu Plan and Approval
+    needs: check-and-create-pr
+    runs-on: ubuntu-latest
+    env:
+      PR_NUMBER: ${{ needs.check-and-create-pr.outputs.pr_number }}
+      PR_URL: ${{ needs.check-and-create-pr.outputs.pr_url }}
+      PR_COMMENTS_URL: ${{ needs.check-and-create-pr.outputs.pr_comments_url }}
+      PR_COMMENT_ID: ${{ needs.check-and-create-pr.outputs.pr_comment_id }}
+      PR_COMMENT_URI: ${{ needs.check-and-create-pr.outputs.pr_comment_uri }}
+      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+    outputs:
+      tofu-cloudflare-plan: ${{ steps.tofu_plan.outputs.plan-output }}
+      approval_status: ${{ steps.tf-plan-approval.outputs.approval_status }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Terraform/OpenTofu"
+          notification_message: "Starting plan..."
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@v1.0.6
+        with:
+          version: ${{ env.OPENTOFU_VERSION }}
+          tofu_wrapper: true
+
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ env.VAULT_TOKEN }}
+          HC_VAULT_SECRETS_PATH: tar-valon-terraform/env
+          ENV_FILE_NAME: cloudflare/.env
+
+      - name: Export env vars from Vault .env
+        id: env-vault-vars
+        run: |
+          sed -i 's/[\"'\'']//g' cloudflare/.env
+          set -a
+          source cloudflare/.env
+          set +a
+          while IFS='=' read -r key value; do
+            if [[ -n "$key" ]]; then
+              echo "$key=$value" >> $GITHUB_ENV
+            fi
+          done < cloudflare/.env
+          repo_name=$(echo "${{ github.repository }}" | awk -F"/" '{print $2}')
+          echo "repo_name=$repo_name" >> "$GITHUB_OUTPUT"
+
+      - name: Run tofu init
+        id: tofu-init
+        uses: dnogu/tofu-init@v1
+        with:
+          working-directory: .
+          chdir: cloudflare
+
+      - name: Strip ANSI codes
+        id: plain-tofu-init
+        uses: marcransome/remove-ansi-colors@v1.7.56
+        with:
+          colored: ${{ steps.tofu-init.outputs.init-output }}
+
+      - name: Tofu PR Commenter
+        uses: https://git.trez.wtf/Trez/tf-pr-commenter@main
+        env:
+          GITEA_API_URL: ${{ gitea.api_url }}
+          GITEA_REPOSITORY: ${{ github.repository }}
+          GITEA_PULL_REQUEST_ID: ${{ github.event.pull_request.number }}
+          GITHUB_TOKEN: ${{ secrets.BOT_GITEA_TOKEN }}
+        with:
+          commenter_type: init
+          commenter_input: ${{ steps.plain-tofu-init.outputs.uncolored }}
+          commenter_exitcode: ${{ steps.tofu-init.outputs.exitcode }}
+          git_token: ${{ secrets.BOT_GITEA_TOKEN }}
+          pr_comments_url: ${{ env.PR_COMMENTS_URL }}
+          working_directory: cloudflare
+
+      - name: Tofu Plan
+        id: tofu-plan
+        continue-on-error: true
+        uses: dnogu/tofu-plan@v1
+        with:
+          working-directory: .
+          chdir: cloudflare
+          out: cloudflare.tfplan
+
+      - name: Upload Tofu Plan as artifact
+        uses: https://github.com/christopherHX/gitea-upload-artifact@v4
+        with:
+          name: cloudflare-tfplan
+          path: cloudflare/cloudflare.tfplan
+
+      - name: Strip ANSI codes
+        id: plain-tofu-plan
+        uses: marcransome/remove-ansi-colors@v1.7.56
+        with:
+          colored: ${{ steps.tofu-plan.outputs.plan-output }}
+
+      - name: Tofu PR Commenter
+        uses: https://git.trez.wtf/Trez/tf-pr-commenter@main
+        env:
+          GITEA_API_URL: ${{ gitea.api_url }}
+          GITEA_REPOSITORY: ${{ github.repository }}
+          GITEA_PULL_REQUEST_ID: ${{ github.event.pull_request.number }}
+          GITHUB_TOKEN: ${{ secrets.BOT_GITEA_TOKEN }}
+        with:
+          commenter_type: plan
+          commenter_input: |
+            <details><summary>Tofu Plan (click to expand)</summary>
+
+            ```terraform
+            ${{ steps.plain-tofu-plan.outputs.uncolored }}
+            ```
+            </details>
+          commenter_exitcode: ${{ steps.tofu-plan.outputs.exitcode }}
+          git_token: ${{ secrets.BOT_GITEA_TOKEN }}
+          pr_comments_url: ${{ env.PR_COMMENTS_URL }}
+          working_directory: cloudflare
+
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Terraform/OpenTofu"
+          notification_message: "Plan completed, awaiting approval..."
+
+      - name: Wait for manual approval
+        id: tf-plan-approval
+        uses: https://git.trez.wtf/Trez/gitea-manual-approval@main
+        with:
+          token: ${{ secrets.BOT_GITEA_TOKEN }}
+          api_url: ${{ gitea.api_url }}
+          repo_owner: ${{ github.repository_owner }}
+          repo_name: ${{ github.event.repository.name }}
+          reminder_interval: 120
+          approvers: "Trez.One,gitea-sonarqube-bot"
+          apprise_api_url: ${{ secrets.APPRISE_URL }}
+          initial_comment: |
+            <details><summary>Tofu Plan (click to expand)</summary>
+
+            ```terraform
+            ${{ steps.plain-tofu-plan.outputs.uncolored }}
+            ```
+            </details>
+
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Terraform/OpenTofu"
+          notification_message: "Plan approved 👍🏽"
+
+  pr-merge:
+    name: PR Merge
+    needs: [check-and-create-pr, plan-approval]
+    env:
+      pr_index: ${{ needs.check-and-create-pr.outputs.pr_number }}
+    if: github.ref != 'refs/heads/main' && ${{ needs.plan-approval.outputs.approval_status == 'approved' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Install tea
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
+        with:
+          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
+          name: tea
+          version: ${{ env.TEA_VERSION }}
+
+      - name: PR Merge
+        id: pr_merge
+        run: |
+          tea login add \
+            --name gitea-rinoa \
+            --url "${{ secrets.TREZ_GITEA_URL }}" \
+            --user gitea-sonarqube-bot \
+            --password "${{ secrets.BOT_GITEA_PASSWORD }}" \
+            --token ${{ secrets.BOT_GITEA_TOKEN }}
+
+          tea login default gitea-rinoa
+
+          echo "Merging PR..."
+
+          tea pr m \
+            --repo ${{ github.repository }} \
+            --title "Auto Merge of PR ${pr_index} - ${{ github.ref_name }}" \
+            --message "Merged by ${{ github.actor }}" ${pr_index}
+
+          echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
+
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Merge Successful"
+          notification_message: "PR #${{ steps.pr_merge.outputs.pr_index }} merged."
+
+  apply:
+    name: Apply Tofu Plan
+    needs: [plan-approval,pr-merge]
+    runs-on: ubuntu-latest
+    if: ${{ needs.plan-approval.outputs.approval_status == 'approved' }}
+    env:
+      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download Tofu Plan
+        uses: https://github.com/ChristopherHX/gitea-download-artifact@v4
+        with:
+          name: cloudflare-tfplan
+          path: cloudflare/cloudflare.tfplan
+
+      - name: Setup OpenTofu
+        uses: opentofu/setup-opentofu@v1.0.6
+        with:
+          version: ${{ env.OPENTOFU_VERSION }}
+          tofu_wrapper: true
+
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ env.VAULT_TOKEN }}
+          HC_VAULT_SECRETS_PATH: tar-valon-terraform/env
+          ENV_FILE_NAME: cloudflare/.env
+
+      - name: Export env vars from Vault .env
+        id: env-vault-vars
+        run: |
+          sed -i 's/[\"'\'']//g' cloudflare/.env
+          set -a
+          source cloudflare/.env
+          set +a
+          while IFS='=' read -r key value; do
+            if [[ -n "$key" ]]; then
+              echo "$key=$value" >> $GITHUB_ENV
+            fi
+          done < cloudflare/.env
+
+      - name: Run tofu init
+        id: tofu-init
+        uses: dnogu/tofu-init@v1
+        with:
+          working-directory: .
+          chdir: cloudflare
+
+      - name: Run Tofu Apply
+        uses: dnogu/tofu-apply@v1
+        with:
+          working-directory: .
+          chdir: cloudflare
+          plan: cloudflare.tfplan

.gitea/workflows/renovate.yml

@@ -0,0 +1,65 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0/30 * * * *"
+  workflow_dispatch:
+
+env:
+  RENOVATE_VERSION: "41.146.8"
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Renovate Run
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: https://git.trez.wtf/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_BOT_TOKEN }}
+          LOG_LEVEL: ${{ vars.RENOVATE_LOG_LEVEL }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }}
+          RENOVATE_CONFIG_FILE: renovate.json
+          RENOVATE_REPOSITORIES: trez/rinoa-docker
+          RENOVATE_HOST_RULES: |
+            [
+              {
+                "description": "Docker Hub authentication",
+                "hostType": "docker",
+                "matchHost": "docker.io",
+                "username": "${{ secrets.DOCKERHUB_USER }}",
+                "password": "${{ secrets.DOCKERHUB_PASSWORD }}"
+              },
+              {
+                "description": "GitHub Container Registry (GHCR)",
+                "hostType": "docker",
+                "matchHost": "ghcr.io",
+                "username": "${{ secrets.GHCR_USER }}",
+                "password": "${{ secrets.GHCR_LOGIN_TOKEN }}"
+              },
+              {
+                "description": "Self-hosted Gitea Docker Registry",
+                "hostType": "docker",
+                "matchHost": "git.trez.wtf",
+                "username": "${{ secrets.BOT_GITEA_USER }}",
+                "password": "${{ secrets.BOT_GITEA_PASSWORD }}"
+              }
+            ]
+        run: |
+          docker run --rm \
+            -e RENOVATE_PLATFORM \
+            -e RENOVATE_ENDPOINT \
+            -e RENOVATE_TOKEN \
+            -e LOG_LEVEL \
+            -e RENOVATE_GITHUB_COM_TOKEN \
+            -e RENOVATE_CONFIG_FILE \
+            -e RENOVATE_REPOSITORIES \
+            -e RENOVATE_HOST_RULES \
+            --volumes-from ${{ env.JOB_CONTAINER_NAME }} \
+            -w ${GITHUB_WORKSPACE} \
+            renovate/renovate:${{ env.RENOVATE_VERSION }}-full

.gitignore

@@ -40,4 +40,7 @@ terraform.rc
 
 # End of https://www.toptal.com/api/terraform
 # Envs
-*.env*
+*.env*
+
+**/*.txt
+**/cloudflare_resource_imp.tf

cloudflare/.terraform.lock.hcl

@@ -2,18 +2,18 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.opentofu.org/cloudflare/cloudflare" {
-  version     = "5.11.0"
+  version     = "5.12.0"
   constraints = "~> 5.0"
   hashes = [
-    "h1:jgb1wjIOM91LvApId25gmz6X5NcfS0e10flOrndNwqM=",
-    "zh:0848e1ac58cbca0adeba216742a5a7054a10386f019d4358eb69afa3ac4dc247",
-    "zh:3212393037e7a5db03d81d652d15a6343befffbf1ed643b5ad60bf4b157762ac",
-    "zh:3d89d228d0931c891b8e3ecdba28182e6a97972d1c1c7088360f7f0a40d49f97",
-    "zh:aef6572e45bdf05765db2976625eaa1997116e17d68e82d36ff0c5090690b758",
-    "zh:b8ba44b1a3a52252b9fe33611310869820e8610e3ae6ca67bb14134dcd20a306",
-    "zh:e0099f6d61c552c3fd7801d06f3d6912cb26dc3d808f97fa69015adcc4485e4d",
-    "zh:e937b5d23a6373417f4e4f80bb89b1865d783af7d7baccf8547c59b4d38707ec",
-    "zh:ed2417b3d7487227bf78c70c372fc9fa711d83ea073755e3ff8484af7ca194c1",
+    "h1:IvMPMJrmyw6x+8GZklY7qb8VXrjr00zwsN+TFlxkCTM=",
+    "zh:06166a72e69eb712ad2c8b49c1ed060223b0d57bb95ce5f6c8440ce19253913e",
+    "zh:484c32dc4fbe1f7baaf00f8d0d1774d259e1a602aebf60b8dea8c6dd122c1d27",
+    "zh:914b4796a5f2c5914cb94864a7541ce132c0e287bf49a5328706d50152117bc4",
+    "zh:bbcf3effe11ad44988c2aa4482c3fd0089ca86527463a9a873cecda1a4a022bc",
+    "zh:c2a59f29b4b4c0344dbb9ab3d78ebcc1d32153f1fd7e919eba7edf7d825119c2",
+    "zh:d6900b39b9c58743e6b1f05b2db7c39276c94f74d501f23bebb88d413266c57c",
+    "zh:f000d33075c30e616df8e58e341614e958eed4a51f3427d2e1a18ea1b7e0c6c6",
     "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
+    "zh:ff4fd5b3b0327f8f41fc65d909839288fb98ecfe32a9aff11d2e2638f2109302",
   ]
 }

cloudflare/cloudflare_argo_tiered_caching.tf

@@ -1,5 +0,0 @@
-resource "cloudflare_argo_tiered_caching" "terraform_managed_resource_tiered_caching_0" {
-  value   = "on"
-  zone_id = "17dbb71212204583b777783d25eb6738"
-}
-

cloudflare/cloudflare_email_routing_dns.tf

@@ -1,25 +0,0 @@
-resource "cloudflare_email_routing_dns" "terraform_managed_resource_17dbb71212204583b777783d25eb6738_0" {
-  name    = "trez.wtf"
-  zone_id = "17dbb71212204583b777783d25eb6738"
-}
-
-resource "cloudflare_email_routing_dns" "terraform_managed_resource_17dbb71212204583b777783d25eb6738_1" {
-  name    = "trez.wtf"
-  zone_id = "17dbb71212204583b777783d25eb6738"
-}
-
-resource "cloudflare_email_routing_dns" "terraform_managed_resource_17dbb71212204583b777783d25eb6738_2" {
-  name    = "trez.wtf"
-  zone_id = "17dbb71212204583b777783d25eb6738"
-}
-
-resource "cloudflare_email_routing_dns" "terraform_managed_resource_17dbb71212204583b777783d25eb6738_3" {
-  name    = "cf2024-1._domainkey.trez.wtf"
-  zone_id = "17dbb71212204583b777783d25eb6738"
-}
-
-resource "cloudflare_email_routing_dns" "terraform_managed_resource_17dbb71212204583b777783d25eb6738_4" {
-  name    = "trez.wtf"
-  zone_id = "17dbb71212204583b777783d25eb6738"
-}
-

cloudflare/cloudflare_email_routing_settings.tf

@@ -1,4 +0,0 @@
-resource "cloudflare_email_routing_settings" "terraform_managed_resource_17dbb71212204583b777783d25eb6738_0" {
-  zone_id = "17dbb71212204583b777783d25eb6738"
-}
-

cloudflare/cloudflare_tiered_cache.tf

@@ -1,5 +0,0 @@
-resource "cloudflare_tiered_cache" "terraform_managed_resource_tiered_cache_smart_topology_enable_0" {
-  value   = "on"
-  zone_id = "17dbb71212204583b777783d25eb6738"
-}
-

cloudflare/cloudflare_zone.tf

@@ -1,11 +0,0 @@
-resource "cloudflare_zone" "terraform_managed_resource_17dbb71212204583b777783d25eb6738_0" {
-  name                = "trez.wtf"
-  paused              = false
-  type                = "full"
-  vanity_name_servers = []
-  account = {
-    id   = "f5a5c0098ccae27fb0486ffbc2ee6087"
-    name = "Charish.patel@trez.wtf's Account"
-  }
-}
-

cloudflare/cloudflare_zone_dnssec.tf

@@ -1,6 +0,0 @@
-resource "cloudflare_zone_dnssec" "terraform_managed_resource_17dbb71212204583b777783d25eb6738_0" {
-  dnssec_multi_signer = true
-  status              = "active"
-  zone_id             = "17dbb71212204583b777783d25eb6738"
-}
-

cloudflare/generate_cf_resources.sh

@@ -1,181 +1,230 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -euo pipefail
 
-cf_generate () {
-  resources=(
-    cloudflare_account
-    cloudflare_account_member
-    cloudflare_account_subscription
-    cloudflare_address_map
-    cloudflare_api_shield_discovery_operation
-    cloudflare_api_shield_operation
-    cloudflare_api_shield_operation_schema_validation_settings
-    cloudflare_api_shield_schema
-    cloudflare_api_shield_schema_validation_settings
-    cloudflare_argo_smart_routing
-    cloudflare_argo_tiered_caching
-    cloudflare_authenticated_origin_pulls
-    cloudflare_authenticated_origin_pulls_certificate
-    cloudflare_bot_management
-    cloudflare_calls_sfu_app
-    cloudflare_calls_turn_app
-    cloudflare_certificate_pack
-    cloudflare_content_scanning_expression
-    cloudflare_custom_hostname
-    cloudflare_custom_hostname_fallback_origin
-    cloudflare_d1_database
-    cloudflare_dns_firewall
-    cloudflare_dns_record
-    cloudflare_dns_zone_transfers_acl
-    cloudflare_dns_zone_transfers_incoming
-    cloudflare_dns_zone_transfers_outgoing
-    cloudflare_dns_zone_transfers_peer
-    cloudflare_dns_zone_transfers_tsig
-    cloudflare_email_routing_address
-    cloudflare_email_routing_catch_all
-    cloudflare_email_routing_dns
-    cloudflare_email_routing_rule
-    cloudflare_email_routing_settings
-    cloudflare_email_security_block_sender
-    cloudflare_email_security_impersonation_registry
-    cloudflare_email_security_trusted_domains
-    cloudflare_filter
-    cloudflare_healthcheck
-    cloudflare_hostname_tls_setting
-    cloudflare_keyless_certificate
-    cloudflare_leaked_credential_check
-    cloudflare_leaked_credential_check_rule
-    cloudflare_list
-    cloudflare_list_item
-    cloudflare_load_balancer
-    cloudflare_load_balancer_monitor
-    cloudflare_load_balancer_pool
-    cloudflare_logpull_retention
-    cloudflare_logpush_job
-    cloudflare_magic_wan_static_route
-    cloudflare_managed_transforms
-    cloudflare_mtls_certificate
-    cloudflare_notification_policy
-    cloudflare_notification_policy_webhooks
-    cloudflare_observatory_scheduled_test
-    cloudflare_origin_ca_certificate
-    cloudflare_page_rule
-    cloudflare_page_shield_policy
-    cloudflare_pages_domain
-    cloudflare_pages_project
-    cloudflare_queue
-    cloudflare_queue_consumer
-    cloudflare_r2_bucket
-    cloudflare_r2_custom_domain
-    cloudflare_r2_managed_domain
-    cloudflare_rate_limit
-    cloudflare_regional_hostname
-    cloudflare_regional_tiered_cache
-    cloudflare_registrar_domain
-    cloudflare_ruleset
-    cloudflare_snippet_rules
-    cloudflare_snippets
-    cloudflare_spectrum_application
-    cloudflare_stream
-    cloudflare_stream_key
-    cloudflare_stream_live_input
-    cloudflare_stream_watermark
-    cloudflare_stream_webhook
-    cloudflare_tiered_cache
-    cloudflare_total_tls
-    cloudflare_turnstile_widget
-    cloudflare_url_normalization_settings
-    cloudflare_user
-    cloudflare_waiting_room
-    cloudflare_waiting_room_event
-    cloudflare_waiting_room_rules
-    cloudflare_waiting_room_settings
-    cloudflare_web3_hostname
-    cloudflare_web_analytics_rule
-    cloudflare_web_analytics_site
-    cloudflare_workers_cron_trigger
-    cloudflare_workers_custom_domain
-    cloudflare_workers_deployment
-    cloudflare_workers_for_platforms_dispatch_namespace
-    cloudflare_workers_kv_namespace
-    cloudflare_workers_script_subdomain
-    cloudflare_zero_trust_access_application
-    cloudflare_zero_trust_access_custom_page
-    cloudflare_zero_trust_access_group
-    cloudflare_zero_trust_access_identity_provider
-    cloudflare_zero_trust_access_infrastructure_target
-    cloudflare_zero_trust_access_key_configuration
-    cloudflare_zero_trust_access_mtls_certificate
-    cloudflare_zero_trust_access_mtls_hostname_settings
-    cloudflare_zero_trust_access_policy
-    cloudflare_zero_trust_access_service_token
-    cloudflare_zero_trust_access_short_lived_certificate
-    cloudflare_zero_trust_access_tag
-    cloudflare_zero_trust_device_custom_profile
-    cloudflare_zero_trust_device_default_profile
-    cloudflare_zero_trust_device_default_profile_certificates
-    cloudflare_zero_trust_device_default_profile_local_domain_fallback
-    cloudflare_zero_trust_device_managed_networks
-    cloudflare_zero_trust_device_posture_integration
-    cloudflare_zero_trust_device_posture_rule
-    cloudflare_zero_trust_dex_test
-    cloudflare_zero_trust_dlp_custom_profile
-    cloudflare_zero_trust_dlp_dataset
-    cloudflare_zero_trust_dlp_predefined_profile
-    cloudflare_zero_trust_dns_location
-    cloudflare_zero_trust_gateway_certificate
-    cloudflare_zero_trust_gateway_policy
-    cloudflare_zero_trust_gateway_proxy_endpoint
-    cloudflare_zero_trust_gateway_settings
-    cloudflare_zero_trust_list
-    cloudflare_zero_trust_organization
-    cloudflare_zero_trust_risk_behavior
-    cloudflare_zero_trust_risk_scoring_integration
-    cloudflare_zero_trust_tunnel_cloudflared
-    cloudflare_zero_trust_tunnel_cloudflared_config
-    cloudflare_zero_trust_tunnel_cloudflared_route
-    cloudflare_zero_trust_tunnel_cloudflared_virtual_network
-    cloudflare_zone
-    cloudflare_zone_cache_reserve
-    cloudflare_zone_cache_variants
-    cloudflare_zone_dnssec
-    cloudflare_zone_lockdown
-    cloudflare_zone_setting
-  )
+# -------------------------------
+# Detect Terraform binary: tofu vs terraform
+# -------------------------------
+if command -v tofu &>/dev/null; then
+    TF_BIN="tofu"
+elif command -v terraform &>/dev/null; then
+    TF_BIN="terraform"
+else
+    echo "❌ Neither 'terraform' nor 'tofu' found in PATH"
+    exit 1
+fi
 
-  for resource in "${resources[@]}"; do
-    echo "Generating ${resource}.tf..."
-    cf-terraforming generate --zone ${CLOUDFLARE_ZONE_ID} --resource-type ${resource} > ${resource}.tf
-  done
+echo "ℹ️ Using $TF_BIN for Terraform operations"
 
-  echo "🧹 Cleaning up empty files..."
-  find . -size  0 -name "*.tf" | xargs rm
-  echo "✅ All Terraform files generated!"
+# -------------------------------
+# Ensure CF API token
+# -------------------------------
+CF_API_TOKEN="${CLOUDFLARE_API_TOKEN:-}"
+if [[ -z "${CF_API_TOKEN}" ]]; then
+    echo "Please set CF_API_TOKEN before running this script."
+    exit 1
+fi
+
+# -------------------------------
+# Helper: fetch paginated results from Cloudflare API
+# -------------------------------
+cf_paginate() {
+    local endpoint="$1"
+    local page=1
+    local per_page=100
+    while :; do
+        local result
+        result=$(curl -s -X GET "${endpoint}?page=${page}&per_page=${per_page}" \
+            -H "Authorization: Bearer ${CF_API_TOKEN}" \
+            -H "Content-Type: application/json")
+        local items
+        items=$(echo "${result}" | jq -r '.result[]? | @base64')
+        [[ -z "$items" ]] && break
+        echo "$items"
+        local total_pages
+        total_pages=$(echo "$result" | jq -r '.result_info.total_pages')
+        ((page++))
+        [[ $page -gt $total_pages ]] && break
+    done
 }
 
-cf_import () {
-  for cfresource in $(find . -type f -name "cloudflare_*.tf"); do
-    echo "Importing ${cfresource}..."
-    cf-terraforming import --zone ${CLOUDFLARE_ZONE_ID} --modern-import-block --resource-type $(echo ${cfresource} | sed -e 's/.\///' -e 's/\.tf//') >> imports.tf
-  done
+# -------------------------------
+# Generate Cloudflare resources using cf-terraforming
+# -------------------------------
+generate_resources() {
+    echo "🔧 Generating Cloudflare resources via cf-terraforming..."
+    local output_file="cloudflare_resource_gen.tf"
+    > "${output_file}"
 
-  echo "✅ All Cloudflare resources imported. Please check imports.tf"
+    resources=(
+        cloudflare_account
+        cloudflare_account_member
+        cloudflare_account_subscription
+        cloudflare_address_map
+        cloudflare_argo_tiered_caching
+        cloudflare_authenticated_origin_pulls
+        cloudflare_authenticated_origin_pulls_certificate
+        cloudflare_bot_management
+        cloudflare_certificate_pack
+        cloudflare_content_scanning_expression
+        cloudflare_custom_hostname
+        cloudflare_custom_hostname_fallback_origin
+        cloudflare_d1_database
+        cloudflare_dns_firewall
+        cloudflare_dns_record
+        cloudflare_dns_zone_transfers_acl
+        cloudflare_dns_zone_transfers_incoming
+        cloudflare_dns_zone_transfers_outgoing
+        cloudflare_dns_zone_transfers_peer
+        cloudflare_dns_zone_transfers_tsig
+        cloudflare_email_routing_address
+        cloudflare_email_routing_catch_all
+        cloudflare_email_routing_dns
+        cloudflare_email_routing_rule
+        cloudflare_email_routing_settings
+        cloudflare_filter
+        cloudflare_healthcheck
+        cloudflare_hostname_tls_setting
+        cloudflare_keyless_certificate
+        cloudflare_leaked_credential_check
+        cloudflare_leaked_credential_check_rule
+        cloudflare_list_item
+        cloudflare_load_balancer
+        cloudflare_load_balancer_monitor
+        cloudflare_load_balancer_pool
+        cloudflare_logpull_retention
+        cloudflare_logpush_job
+        cloudflare_magic_wan_static_route
+        cloudflare_managed_transforms
+        cloudflare_mtls_certificate
+        cloudflare_notification_policy
+        cloudflare_notification_policy_webhooks
+        cloudflare_observatory_scheduled_test
+        cloudflare_origin_ca_certificate
+        cloudflare_page_rule
+        cloudflare_page_shield_policy
+        cloudflare_pages_domain
+        cloudflare_pages_project
+        cloudflare_queue
+        cloudflare_queue_consumer
+        cloudflare_r2_bucket
+        cloudflare_r2_custom_domain
+        cloudflare_r2_managed_domain
+        cloudflare_rate_limit
+        cloudflare_regional_hostname
+        cloudflare_regional_tiered_cache
+        cloudflare_registrar_domain
+        cloudflare_ruleset
+        cloudflare_snippet_rules
+        cloudflare_snippets
+        cloudflare_spectrum_application
+        cloudflare_stream
+        cloudflare_stream_key
+        cloudflare_stream_live_input
+        cloudflare_stream_watermark
+        cloudflare_stream_webhook
+        cloudflare_tiered_cache
+        cloudflare_total_tls
+        cloudflare_turnstile_widget
+        cloudflare_url_normalization_settings
+        cloudflare_user
+        cloudflare_waiting_room
+        cloudflare_waiting_room_event
+        cloudflare_waiting_room_rules
+        cloudflare_waiting_room_settings
+        cloudflare_web3_hostname
+        cloudflare_web_analytics_rule
+        cloudflare_web_analytics_site
+        cloudflare_workers_cron_trigger
+        cloudflare_workers_custom_domain
+        cloudflare_workers_deployment
+        cloudflare_workers_for_platforms_dispatch_namespace
+        cloudflare_workers_kv_namespace
+        cloudflare_workers_script_subdomain
+        cloudflare_zone
+        cloudflare_zone_cache_reserve
+        cloudflare_zone_cache_variants
+        cloudflare_zone_dnssec
+        cloudflare_zone_lockdown
+        cloudflare_zone_setting
+    )
+
+    for r in "${resources[@]}"; do
+        echo "Generating $r ..."
+        cf-terraforming generate \
+            --token "${CF_API_TOKEN}" \
+            --resource-type "${r}" >> "${output_file}" || true
+    done
+
+    echo "✅ Terraform resources generated in ${output_file}"
 }
 
-# Prompt user for input
+# -------------------------------
+# Import Cloudflare resources into state using cf-terraforming
+# -------------------------------
+import_zone_resources() {
+    local zone_id="$1"
+    local zone_name="$2"
+
+    echo "⏳ Importing zone $zone_name ..."
+    cf-terraforming import \
+        --token "${CF_API_TOKEN}" \
+        --modern-import-block \
+        --resource-type cloudflare_zone \
+        --resource-id "$zone_id" >> cloudflare_resource_imp.tf || true
+    echo "✅ Imported cloudflare_zone for $zone_name"
+
+    echo "🔄 Importing DNS records for $zone_name ..."
+    cf-terraforming import \
+        --token "${CF_API_TOKEN}" \
+        --zone "$zone_id" \
+        --modern-import-block \
+        --resource-type cloudflare_dns_record >> cloudflare_resource_imp.tf || true
+    echo "✅ Imported DNS records for $zone_name"
+
+    # Optional: import other zone-level resources
+    for res in cloudflare_argo_tiered_caching cloudflare_email_routing_settings cloudflare_tiered_cache cloudflare_zone_dnssec; do
+        cf-terraforming import \
+            --token "${CF_API_TOKEN}" \
+            --resource-type "$res" \
+            --modern-import-block \
+            --resource-id "$zone_id" >> cloudflare_resource_imp.tf || true
+        echo "✅ Imported $res for $zone_name"
+    done
+}
+
+# -------------------------------
+# Main
+# -------------------------------
 echo "Choose an option:"
 echo "1) Generate Cloudflare Terraform resources"
-echo "2) Import Cloudflare Terraform resources"
-read -rp "Enter 1 or 2: " user_choice
+echo "2) Import Cloudflare Terraform resources into state"
+read -rp "Enter 1 or 2: " choice
 
-case "$user_choice" in
-  1)
-    cf_generate
-    ;;
-  2)
-    cf_import
-    ;;
-  *)
-    echo "Invalid option. Please enter 1 or 2."
-    exit 1
-    ;;
+case "$choice" in
+    1)
+        generate_resources
+        ;;
+    2)
+        echo "🔄 Fetching zones..."
+        zones=$(cf_paginate "https://api.cloudflare.com/client/v4/zones")
+        declare -A zone_map
+        while read -r z; do
+            zname=$(echo "$z" | base64 --decode | jq -r '.name')
+            zid=$(echo "$z" | base64 --decode | jq -r '.id')
+            zone_map["$zname"]="$zid"
+        done <<< "$zones"
+
+        echo "⚡ Found ${#zone_map[@]} zones."
+
+        for zone_name in "${!zone_map[@]}"; do
+            zid="${zone_map[$zone_name]}"
+            import_zone_resources "$zid" "$zone_name"
+        done
+        ;;
+    *)
+        echo "Invalid option. Enter 1 or 2."
+        exit 1
+        ;;
 esac
+
+echo "🎉 All operations completed!"

gitea/env.example

@@ -0,0 +1 @@
+GITEA_TOKEN=""

gitea/gitea-orgs.tf

@@ -0,0 +1,6 @@
+// Generated by gitea-terraforming (OpenTofu compatible)
+
+# source id=52
+resource "gitea_organization" "org_trez" {
+  name = "Trez"
+}

gitea/gitea-repos.tf

@@ -0,0 +1,121 @@
+// Generated by gitea-terraforming (OpenTofu compatible)
+
+# source id=5
+resource "gitea_repository" "repo_trez_rinoa-docker" {
+  owner = "Trez"
+  name = "rinoa-docker"
+  private = false
+  description = ""
+}
+
+# source id=9
+resource "gitea_repository" "repo_trez_meraki-naemon" {
+  owner = "Trez"
+  name = "meraki-naemon"
+  private = false
+  description = ""
+}
+
+# source id=13
+resource "gitea_repository" "repo_trez_benedikta-ovos" {
+  owner = "Trez"
+  name = "benedikta-ovos"
+  private = false
+  description = ""
+}
+
+# source id=16
+resource "gitea_repository" "repo_trez_rikku-home-assistant" {
+  owner = "Trez"
+  name = "rikku-home-assistant"
+  private = false
+  description = ""
+}
+
+# source id=17
+resource "gitea_repository" "repo_trez_tar-valon-terraform" {
+  owner = "Trez"
+  name = "tar-valon-terraform"
+  private = true
+  description = ""
+}
+
+# source id=18
+resource "gitea_repository" "repo_trez_hugo_it-services" {
+  owner = "Trez"
+  name = "hugo_it-services"
+  private = false
+  description = ""
+}
+
+# source id=19
+resource "gitea_repository" "repo_trez_docker-mods-uptime-kuma-timeout-fix" {
+  owner = "Trez"
+  name = "docker-mods-uptime-kuma-timeout-fix"
+  private = false
+  description = "Documentation and Examples of base container modifications"
+}
+
+# source id=21
+resource "gitea_repository" "repo_trez_tar-valon-ansible" {
+  owner = "Trez"
+  name = "tar-valon-ansible"
+  private = false
+  description = ""
+}
+
+# source id=22
+resource "gitea_repository" "repo_trez_congo-hindi-gujarati" {
+  owner = "Trez"
+  name = "congo-hindi-gujarati"
+  private = false
+  description = "A powerful, lightweight theme for Hugo built with Tailwind CSS."
+}
+
+# source id=26
+resource "gitea_repository" "repo_trez_action-home-assistant" {
+  owner = "Trez"
+  name = "action-home-assistant"
+  private = false
+  description = "🚀 Frenck's GitHub Action for running a Home Assistant Core configuration check"
+}
+
+# source id=27
+resource "gitea_repository" "repo_trez_renovate-config" {
+  owner = "Trez"
+  name = "renovate-config"
+  private = false
+  description = ""
+}
+
+# source id=31
+resource "gitea_repository" "repo_trez_hc-vault-env" {
+  owner = "Trez"
+  name = "hc-vault-env"
+  private = false
+  description = ""
+}
+
+# source id=32
+resource "gitea_repository" "repo_trez_docker-select-image-pull" {
+  owner = "Trez"
+  name = "docker-select-image-pull"
+  private = false
+  description = ""
+}
+
+# source id=33
+resource "gitea_repository" "repo_trez_gitea-auto-pr" {
+  owner = "Trez"
+  name = "gitea-auto-pr"
+  private = false
+  description = ""
+}
+
+# source id=34
+resource "gitea_repository" "repo_trez_ultima-ai" {
+  owner = "Trez"
+  name = "ultima-ai"
+  private = true
+  description = ""
+}

gitea/gitea-terraforming.py

@@ -0,0 +1,274 @@
+#!/usr/bin/env python3
+"""
+gitea-terraforming: Reverse Terraform for Gitea (OpenTofu compatible)
+
+Generates Terraform HCL for:
+- Users
+- Organizations
+- Repositories (user & org)
+- Branch protections
+
+Output files are automatically split per resource type:
+gitea-<resource-type>.tf
+
+Supports import generation:
+- Modern import blocks (--modern-import-block)
+- Shell script terraform import
+
+Usage example:
+    python gitea_terraforming.py --api https://gitea.example.com --token <ADMIN_TOKEN> --out-dir ./gitea_tf
+"""
+
+import argparse, os, sys, time, json, re
+from typing import Any, Dict, List, Optional
+from datetime import datetime
+import requests
+
+def slugify(s: str) -> str:
+	s = re.sub(r'[^0-9a-zA-Z_-]', '_', s)
+	return re.sub('_+', '_', s).strip('_').lower()
+
+class GiteaClient:
+	def __init__(self, api_base: str, token: str, verify: bool = True):
+		self.base = api_base.rstrip('/')
+		self.s = requests.Session()
+		self.s.headers.update({
+			'Authorization': f'token {token}',
+			'Accept': 'application/json',
+			'User-Agent': 'gitea-terraforming/0.1'
+		})
+		self.verify = verify
+
+	def _get(self, path: str, params: Optional[dict] = None):
+		url = f"{self.base}{path}"
+		out = []
+		page = 1
+		while True:
+			qp = params.copy() if params else {}
+			qp.update({'page': page, 'limit': 100})
+			resp = self.s.get(url, params=qp, verify=self.verify, timeout=30)
+			if resp.status_code == 404:
+				return []
+			if resp.status_code == 429:
+				retry = int(resp.headers.get('Retry-After', '5'))
+				time.sleep(retry)
+				continue
+			resp.raise_for_status()
+			data = resp.json()
+			if isinstance(data, list):
+				out.extend(data)
+				if len(data) < 100:
+					break
+				page += 1
+			else:
+				return data
+		return out
+
+	def list_orgs(self) -> List[dict]:
+		return self._get("/api/v1/orgs")
+
+	def list_users(self) -> List[dict]:
+		return self._get("/api/v1/admin/users")
+
+	def list_user_repos(self, user: str) -> List[dict]:
+		return self._get(f"/api/v1/users/{user}/repos")
+
+	def list_org_repos(self, org: str) -> List[dict]:
+		return self._get(f"/api/v1/orgs/{org}/repos")
+
+	def list_branch_protections(self, owner: str, repo: str) -> List[dict]:
+		return self._get(f"/api/v1/repos/{owner}/{repo}/branch_protections")
+
+def hcl_block(resource_type: str, name: str, attrs: dict, comment: Optional[str] = None) -> str:
+	lines = []
+	if comment:
+		lines.append(f"# {comment}")
+	lines.append(f'resource "{resource_type}" "{name}" ' + "{")
+	for k, v in attrs.items():
+		if v is None:
+			continue
+		if isinstance(v, bool):
+			lines.append(f"  {k} = {str(v).lower()}")
+		elif isinstance(v, (int, float)):
+			lines.append(f"  {k} = {v}")
+		elif isinstance(v, str):
+			safe = v.replace('"', '\\"')
+			lines.append(f'  {k} = "{safe}"')
+		elif isinstance(v, list):
+			joined = ", ".join([f'"{x}"' for x in v])
+			lines.append(f"  {k} = [{joined}]")
+		else:
+			lines.append(f'  # {k} = {json.dumps(v)}')
+	lines.append("}\n")
+	return "\n".join(lines)
+
+def modern_import_block(to: str, ident: str) -> str:
+	return f'import {{\n  to = {to}\n  id = "{ident}"\n}}\n'
+
+def generate(api: str, token: str, out_dir: str, modern: bool = False, dry: bool = False):
+	client = GiteaClient(api, token)
+	os.makedirs(out_dir, exist_ok=True)
+	imports = []
+	files: dict = {}
+
+	orgs = client.list_orgs()
+	org_buf = []
+	for o in orgs:
+		uname = o.get("username") or o.get("user_name") or o.get("name")
+		rname = f"org_{slugify(uname)}"
+		attrs = {"name": uname}
+		org_buf.append(hcl_block("gitea_organization", rname, attrs, comment=f"source id={o.get('id')}"))
+		imports.append((f"gitea_organization.{rname}", uname))
+	if org_buf:
+		files["orgs"] = "\n".join(org_buf)
+
+	users = []
+	try:
+		users = client.list_users()
+	except Exception as e:
+		print(f"Warning: cannot list users: {e}", file=sys.stderr)
+	user_buf = []
+	for u in users:
+		uname = u.get("login") or u.get("username")
+		if not uname:
+			continue
+		rname = f"user_{slugify(uname)}"
+		attrs = {
+			"username": uname,
+			"email": u.get("email"),
+			"full_name": u.get("full_name"),
+			"is_admin": u.get("is_admin")
+		}
+		user_buf.append(hcl_block("gitea_user", rname, attrs, comment=f"source id={u.get('id')}"))
+		imports.append((f"gitea_user.{rname}", uname))
+	if user_buf:
+		files["users"] = "\n".join(user_buf)
+
+	repo_buf = []
+	for u in users:
+		uname = u.get("login") or u.get("username")
+		if not uname:
+			continue
+		try:
+			repos = client.list_user_repos(uname)
+		except Exception:
+			repos = []
+		for r in repos:
+			rname = f"repo_{slugify(uname)}_{slugify(r['name'])}"
+			attrs = {
+				"owner": uname,
+				"name": r["name"],
+				"private": r.get("private", False),
+				"description": r.get("description")
+			}
+			repo_buf.append(hcl_block("gitea_repository", rname, attrs, comment=f"source id={r.get('id')}"))
+			imports.append((f"gitea_repository.{rname}", f"{uname}/{r['name']}"))
+	for o in orgs:
+		uname = o.get("username") or o.get("user_name") or o.get("name")
+		if not uname:
+			continue
+		try:
+			repos = client.list_org_repos(uname)
+		except Exception:
+			repos = []
+		for r in repos:
+			rname = f"repo_{slugify(uname)}_{slugify(r['name'])}"
+			attrs = {
+				"owner": uname,
+				"name": r["name"],
+				"private": r.get("private", False),
+				"description": r.get("description")
+			}
+			repo_buf.append(hcl_block("gitea_repository", rname, attrs, comment=f"source id={r.get('id')}"))
+			imports.append((f"gitea_repository.{rname}", f"{uname}/{r['name']}"))
+	if repo_buf:
+		files["repos"] = "\n".join(repo_buf)
+
+	bp_buf = []
+	for to, ident in imports:
+		if not to.startswith("gitea_repository."):
+			continue
+		owner, repo = ident.split("/", 1)
+		try:
+			bps = client.list_branch_protections(owner, repo)
+		except Exception:
+			bps = []
+		for bp in bps:
+			branch_name = bp.get("branch_name") or bp.get("branch") or bp.get("name")
+			if branch_name is None:
+				continue
+			bn = f"branch_protection_{slugify(owner)}_{slugify(repo)}_{slugify(branch_name)}"
+			attrs = {
+				"repository": repo,
+				"owner": owner,
+				"branch": branch_name,
+				"enable_status_check": bp.get("enable_status_check", False),
+				"required_approvals": bp.get("required_approvals", 0),
+				"enable_merge_whitelist": bp.get("enable_merge_whitelist", False),
+			}
+			bp_buf.append(hcl_block("gitea_branch_protection", bn, attrs, comment=f"protect branch {branch_name}"))
+			imports.append((f"gitea_branch_protection.{bn}", f"{owner}/{repo}/{branch_name}"))
+	if bp_buf:
+		files["branches"] = "\n".join(bp_buf)
+
+	for rtype, content in files.items():
+		fname = f"gitea-{rtype}.tf"
+		fpath = os.path.join(out_dir, fname)
+		if dry:
+			print(f"--- {fpath} ---")
+			print(content)
+		else:
+			with open(fpath, "w", encoding="utf-8") as f:
+				f.write(f"// Generated by gitea-terraforming (OpenTofu compatible)\n\n")
+				f.write(content)
+			print(f"Wrote {fname}", file=sys.stderr)
+
+	if modern:
+		imps = "\n".join([modern_import_block(to, ident) for to, ident in imports])
+		imppath = os.path.join(out_dir, "imports.tf")
+		if dry:
+			print("--- imports.tf ---")
+			print(imps)
+		else:
+			with open(imppath, "w", encoding="utf-8") as f:
+				f.write("// Import blocks\n\n")
+				f.write(imps)
+			print(f"Wrote imports.tf", file=sys.stderr)
+	else:
+		lines = ["#!/usr/bin/env bash", "set -euo pipefail"]
+		lines += [f'terraform import {to} "{ident}"' for to, ident in imports]
+		imppath = os.path.join(out_dir, "terraform_imports.sh")
+		if dry:
+			print("--- terraform_imports.sh ---")
+			print("\n".join(lines))
+		else:
+			with open(imppath, "w", encoding="utf-8") as f:
+				f.write("\n".join(lines) + "\n")
+			os.chmod(imppath, 0o755)
+			print(f"Wrote terraform_imports.sh", file=sys.stderr)
+
+def main():
+	parser = argparse.ArgumentParser(
+		description="gitea-terraforming: Reverse Terraform for Gitea (OpenTofu compatible)\n\n"
+					"Generates Terraform HCL for users, organizations, repositories, and branch protections.\n"
+					"Output files are split per resource type and timestamped.\n\n"
+					"Example usage:\n"
+					"  python gitea_terraforming.py --api https://gitea.example.com --token <ADMIN_TOKEN> --out-dir ./gitea_tf\n",
+		formatter_class=argparse.RawTextHelpFormatter
+	)
+	parser.add_argument("--api", required=True, help="Gitea API URL (e.g., https://gitea.example.com)")
+	parser.add_argument("--token", default=os.environ.get("GITEA_TOKEN"),
+						help="Gitea admin token (or set GITEA_TOKEN environment variable)")
+	parser.add_argument("--out-dir", default="./gitea_tf", help="Directory to write Terraform files")
+	parser.add_argument("--modern-import-block", action="store_true",
+						help="Generate modern OpenTofu import blocks (imports.tf) instead of shell script")
+	parser.add_argument("--dry-run", action="store_true", help="Print output instead of writing files")
+	args = parser.parse_args()
+
+	if not args.token:
+		parser.error("Missing Gitea token: provide --token or set GITEA_TOKEN environment variable")
+
+	generate(args.api, args.token, args.out_dir, modern=args.modern_import_block, dry=args.dry_run)
+
+if __name__ == "__main__":
+	main()

gitea/gitea-users.tf

@@ -0,0 +1,33 @@
+// Generated by gitea-terraforming (OpenTofu compatible)
+
+# source id=3
+resource "gitea_user" "user_gitea-sonarqube-bot" {
+  username = "gitea-sonarqube-bot"
+  email = "trezone@vivaldi.net"
+  full_name = ""
+  is_admin = false
+}
+
+# source id=51
+resource "gitea_user" "user_renovate-bot" {
+  username = "renovate-bot"
+  email = "charish2k1@gmail.com"
+  full_name = ""
+  is_admin = false
+}
+
+# source id=1
+resource "gitea_user" "user_root" {
+  username = "root"
+  email = "noreply@trez.wtf"
+  full_name = ""
+  is_admin = true
+}
+
+# source id=2
+resource "gitea_user" "user_trez_one" {
+  username = "Trez.One"
+  email = "charish.patel@trez.wtf"
+  full_name = ""
+  is_admin = false
+}

gitea/imports.tf

@@ -0,0 +1,101 @@
+// Import blocks
+
+import {
+  to = gitea_organization.org_trez
+  id = "Trez"
+}
+
+import {
+  to = gitea_user.user_gitea-sonarqube-bot
+  id = "gitea-sonarqube-bot"
+}
+
+import {
+  to = gitea_user.user_renovate-bot
+  id = "renovate-bot"
+}
+
+import {
+  to = gitea_user.user_root
+  id = "root"
+}
+
+import {
+  to = gitea_user.user_trez_one
+  id = "Trez.One"
+}
+
+import {
+  to = gitea_repository.repo_trez_rinoa-docker
+  id = "Trez/rinoa-docker"
+}
+
+import {
+  to = gitea_repository.repo_trez_meraki-naemon
+  id = "Trez/meraki-naemon"
+}
+
+import {
+  to = gitea_repository.repo_trez_benedikta-ovos
+  id = "Trez/benedikta-ovos"
+}
+
+import {
+  to = gitea_repository.repo_trez_rikku-home-assistant
+  id = "Trez/rikku-home-assistant"
+}
+
+import {
+  to = gitea_repository.repo_trez_tar-valon-terraform
+  id = "Trez/tar-valon-terraform"
+}
+
+import {
+  to = gitea_repository.repo_trez_hugo_it-services
+  id = "Trez/hugo_it-services"
+}
+
+import {
+  to = gitea_repository.repo_trez_docker-mods-uptime-kuma-timeout-fix
+  id = "Trez/docker-mods-uptime-kuma-timeout-fix"
+}
+
+import {
+  to = gitea_repository.repo_trez_tar-valon-ansible
+  id = "Trez/tar-valon-ansible"
+}
+
+import {
+  to = gitea_repository.repo_trez_congo-hindi-gujarati
+  id = "Trez/congo-hindi-gujarati"
+}
+
+import {
+  to = gitea_repository.repo_trez_action-home-assistant
+  id = "Trez/action-home-assistant"
+}
+
+import {
+  to = gitea_repository.repo_trez_renovate-config
+  id = "Trez/renovate-config"
+}
+
+import {
+  to = gitea_repository.repo_trez_hc-vault-env
+  id = "Trez/hc-vault-env"
+}
+
+import {
+  to = gitea_repository.repo_trez_docker-select-image-pull
+  id = "Trez/docker-select-image-pull"
+}
+
+import {
+  to = gitea_repository.repo_trez_gitea-auto-pr
+  id = "Trez/gitea-auto-pr"
+}
+
+import {
+  to = gitea_repository.repo_trez_ultima-ai
+  id = "Trez/ultima-ai"
+}

signoz/main.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     signoz = {
       source = "signoz/signoz"
-      version = "0.0.9"
+      version = "0.0.13"
     }
   }