Skip to content

Access control (team-only)

Team: rafael.gonzalez.albes and alex only.

Public without login:

Everything else requires an account on the relevant service.

Portfolio: website vs git vs CI

Surface Google / SEO Direct URL Login for content
Live site (rafaelgonzalezalbes.com) Indexable (robots, sitemap) Public No
Portfolio git (git…/portfolio) Not indexed (noindex on git.*) Public No
Portfolio CI (ci…/portfolio) Not indexed (noindex on ci.*) Public No
Other git repos (bioscan/*, infra/*) Not indexed 404 / login required Yes (you + alex)
Platform (pm, status, security, docs, …) X-Robots-Tag: noindex via Traefik Works if you know URL Yes

Making the portfolio repo public does not expose other repos. BioScanCheck and infra repos stay private.

Per service

Service URL Who can access How
Portfolio website rafaelgonzalezalbes.com Everyone Static files on IONOS
Portfolio Forgejo repo git.*/rafael.gonzalez.albes/portfolio Everyone Public repo (open-portfolio-public.sh)
Portfolio Woodpecker ci.*/repos/.../portfolio Everyone Public project visibility
Other Forgejo repos git.* Rafael + Alex Login; registration disabled
Woodpecker (other repos) ci.* Rafael + Alex Forgejo OAuth; private projects
Plane pm.* Rafael + Alex Invite-only (ENABLE_SIGNUP=0)
Uptime Kuma status.* Rafael + Alex Login; no public status page
Netdata metrics.* Rafael + Alex Traefik HTTP basic auth (user metric)
Docs docs.* Rafael + Alex Traefik noindex; team knowledge base
DefectDojo security.* Rafael + Alex Login; Traefik noindex
Plane MCP mcp.* Rafael + Alex Plane OAuth
Bridge bridge.* Webhooks only Shared secrets (not for browsing)

Apply lockdown on VPS

After sync-to-server.sh:

ssh bioscan-vps
cd /opt/devops
bash scripts/lockdown-platform.sh

This script:

  1. Verifies Forgejo has only the two team users
  2. Sets non-portfolio repos to private (does not re-private portfolio)
  3. Unpublishes the Kuma /status/platform page
  4. Confirms Plane ENABLE_SIGNUP=0
  5. Sets WOODPECKER_ADMIN=rafael.gonzalez.albes,alex

Open portfolio CI showcase (one-time or after lockdown)

ssh bioscan-vps
cd /opt/devops
bash scripts/open-portfolio-public.sh

Onboard Alex (one-time checklist)

  1. Forgejo account alex exists
  2. bash scripts/add-alex-to-infra.sh and bash scripts/add-alex-to-bioscan.sh
  3. Plane → Workspace settings → Members → invite alex
  4. Uptime Kuma → on VPS: bash scripts/kuma-add-user.sh alex '<password>' (v2.4 has no Users UI yet)
  5. Alex logs into Woodpecker via Forgejo OAuth

Full step-by-step for Alex: Team onboarding.

Audit access

ssh bioscan-vps
PLANE_API_KEY='...' PLANE_WORKSPACE_SLUG='rafael-gonzalez-albes' bash /opt/devops/scripts/audit-team-access.sh

Or use the infra-ops MCP tool audit_team_access (runs on VPS via SSH).

Security notes

  • Woodpecker secrets (SFTP, Plane API key) are owner-only — public project visibility does not expose them.
  • Do not set WOODPECKER_OPEN=true — that enables registration, not public builds.
  • Do not commit local/.env, secrets/plain/*, or API tokens.
  • Rotate tokens if plain secrets were ever committed (scripts/rotate-exposed-secrets.md).
  • Traefik adds X-Robots-Tag: noindex, nofollow on platform subdomains.
  • Woodpecker clone fails after making a non-portfolio repo private → run bash scripts/refresh-woodpecker-forgejo-token.sh, then bash scripts/fix-portfolio-repo-private.sh only if you intentionally re-private portfolio.

Repo visibility policy

Repo Visibility
rafael.gonzalez.albes/portfolio Public (source + CI open; live site on IONOS)
infra/devops Private
bioscan/bioscancheck Private
alex/wearlab-main Private
Future bioscan/* apps Private