I would have a standalone Forgejo server to act as your infrastructure server. Make it separate from your production k8s/k3s environment.
If something knocks out your infrastructure Forgejo instance then your prod instance will continue to work. If something knocks out your prod, then your infrastructure instance is still there to pull on.

One of the reasons I suggest k8s/k3s if something happens k8s/k3s will try to automatically bring the broken node back online.

If I am understanding correctly I would run Forgejo in a k8s/k3s pod

This will be your starting point but you would have to modify the setup to bring it into k8s or k3s

https://forgejo.org/docs/next/admin/installation-docker/

What I have seen people do in the past is use ansible secrets to secure the env file.

So only when the playbook is running does the env get decrypted.

Digital Ocean has an extensive how to on it.

https://www.digitalocean.com/community/tutorials/how-to-use-vault-to-protect-sensitive-ansible-data

Average gaming PC.

128GB ram and a 4070 12GB. Doesn’t sound average.

I assume you have root login denied in your ssh config, other things would be having fail2ban and some geofencing (blocking IPs from countries you know you are never going to log in from).

40? Kinda curious what you are running now.

Do you not normally read patch notes before patching?

Using public property for private usage likely fall on the bad side of acceptable use policies.

That was my thought.

I am in favour of this.

Go with the second option.

Having Netbox as your source of truth is what we do and we can easily track changes

It’s a good goal to have, but expecting it from the early access release isn’t the right mindset.

Going in expecting the game to be a 1:1 Sims replacement is a bit much.

I do hope it improves over time.

Are you taking about Jim’s Garage?

I call them regurgitation machines prone to hallucinations.

How do you do that without needing a pak for that repo?

Unless I am doing something Wong which is always likely.

I am a simple person.

My PC: Panda
My wifes PC: notpanda
Docker VM: dockerhost.home

Jim’s Garage just did a video on this. He made a docker stack for beginners with directions to his actual videos containing the more in-depth about each service being deployed.

https://www.youtube.com/watch?v=_EivPI2qRs8

Does badly count as a way?

I kinda keep an eye on that https://selfh.st/ post that does a weekly roundup of stuff to know when I need to do patching.

No doubt there is a container I could run that would do it for me. I just can’t remember the name of it.

Oh no! gaming division went from $3.2B to $2.5B while our datacenter division went from $30B to $35B