@yunuseon/kayra 0.0.0-stage → 0.4.0

package/cloud-init.yml.tpl

@@ -0,0 +1,14 @@
+#cloud-config
+# Only what Ansible needs to get in. Everything else (packages, Docker, swap,
+# SSH hardening) is the common and docker roles' job: they run on every
+# deploy, while this runs once on first boot and can never be re-applied.
+
+hostname: ${hostname}
+
+users:
+  - name: deploy
+    groups: sudo
+    shell: /bin/bash
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    ssh_authorized_keys:
+      - ${ssh_pubkey}

package/compose/authelia/configuration.yml

@@ -0,0 +1,138 @@
+# =============================================================================
+# Authelia — login for the platform's own pages (Jenkins, Traefik's
+# dashboard). Apps bring their own login; their users never live here.
+#
+# Authelia does NOT expand ${VAR} the way docker compose does. Interpolation here
+# comes from the `template` config filter (X_AUTHELIA_CONFIG_FILTERS=template),
+# which is Go templating: {{ env "DOMAIN" }}.
+#
+# Secrets are never in this file — they arrive as AUTHELIA_*_FILE env vars.
+# =============================================================================
+
+theme: 'auto'
+
+server:
+  address: 'tcp://0.0.0.0:9091/'
+
+log:
+  level: 'info'
+  format: 'text'
+
+# Passkeys are the point of this setup; TOTP and Duo would only be extra
+# surface to configure and explain.
+totp:
+  disable: true
+duo_api:
+  disable: true
+
+webauthn:
+  disable: false
+  enable_passkey_login: true
+  # A passkey assertion carrying the user-verification flag satisfies the
+  # two_factor policy on its own, so login is one Touch ID prompt rather than
+  # password-then-passkey. A stolen bootstrap password alone reaches nothing.
+  experimental_enable_passkey_uv_two_factors: true
+  display_name: '{{ env "DOMAIN" }}'
+  attestation_conveyance_preference: 'indirect'
+  timeout: '60 seconds'
+  selection_criteria:
+    attachment: ''
+    discoverability: 'required'
+    # 'required', not the default 'preferred': with 'preferred' an authenticator
+    # may omit the user-verification flag, and the user is then stuck unable to
+    # satisfy a two_factor policy.
+    user_verification: 'required'
+
+identity_validation:
+  elevated_session:
+    code_lifespan: '5 minutes'
+    elevation_lifespan: '10 minutes'
+    characters: 8
+    require_second_factor: false
+    # Once someone has one passkey, registering a second skips the one-time
+    # code entirely.
+    skip_second_factor: true
+
+authentication_backend:
+  refresh_interval: 'always'
+  # Both disabled so Authelia never writes back to users_database.yml. That
+  # file is rendered from vault on every platform run and would otherwise be
+  # silently reverted.
+  password_reset:
+    disable: true
+  password_change:
+    disable: true
+  file:
+    path: '/config/users_database.yml'
+    watch: true
+    search:
+      email: true
+      case_insensitive: true
+    password:
+      algorithm: 'argon2'
+      argon2:
+        variant: 'argon2id'
+        iterations: 3
+        # KiB, allocated per concurrent hash. The default 64 MiB is too fat for
+        # a 4 GB box with no headroom; 32 MiB is still strong for a credential
+        # used once per person, at enrolment.
+        memory: 32768
+        parallelism: 2
+        key_length: 32
+        salt_length: 16
+
+# AUTH_POLICY is always set by the platform role (default two_factor); test
+# lowers it to one_factor so staging does not need passkey enrolment.
+access_control:
+  default_policy: 'deny'
+  rules:
+    - domain: 'jenkins.{{ env "DOMAIN" }}'
+      policy: '{{ env "AUTH_POLICY" }}'
+      subject:
+        - 'group:admin'
+    - domain: 'traefik.{{ env "DOMAIN" }}'
+      policy: '{{ env "AUTH_POLICY" }}'
+      subject:
+        - 'group:admin'
+
+session:
+  name: 'authelia_session'
+  same_site: 'lax'
+  # A working day of idle time. Shorter is tempting, but a session that dies
+  # mid-form turns the next POST into a 302 to the portal and the body is lost.
+  inactivity: '8 hours'
+  expiration: '1 day'
+  remember_me: '1 week'
+  cookies:
+      # The apex, not auth.<DOMAIN> — the cookie has to reach jenkins.<DOMAIN>
+      # and traefik.<DOMAIN> too. Authelia requires this to be a suffix of (or equal to) authelia_url.
+    - domain: '{{ env "DOMAIN" }}'
+      authelia_url: 'https://auth.{{ env "DOMAIN" }}'
+
+regulation:
+  max_retries: 3
+  find_time: '2 minutes'
+  ban_time: '5 minutes'
+
+storage:
+  local:
+    path: '/data/db.sqlite3'
+
+# SMTP when it is configured, otherwise write to a file. The notifier is only
+# used for the one-time code at passkey enrolment, so the file fallback keeps
+# dev working without an external dependency.
+notifier:
+  disable_startup_check: false
+{{- if env "SMTP_ADDRESS" }}
+  smtp:
+    address: '{{ env "SMTP_ADDRESS" }}'
+    username: '{{ env "SMTP_USERNAME" }}'
+    sender: '{{ env "SMTP_SENDER" }}'
+    # In the template rather than an env var on purpose: an empty
+    # AUTHELIA_NOTIFIER_SMTP_PASSWORD still creates notifier.smtp, and Authelia
+    # then refuses to start with both notifiers configured.
+    password: {{ secret "/config/secrets/smtp_password" | msquote }}
+{{- else }}
+  filesystem:
+    filename: '/data/notification.txt'
+{{- end }}

package/compose/buildkit/buildkitd.toml

@@ -0,0 +1,14 @@
+# BuildKit daemon config.
+#
+# The registry is plain HTTP on the internal docker network and has no TLS
+# anywhere. BuildKit has to be told that explicitly or it tries HTTPS.
+
+[worker.oci]
+  enabled = true
+  # Rootless: no process sandbox, and the rootless worker cannot use overlayfs
+  # on every kernel, so let BuildKit pick a snapshotter it can actually run.
+  max-parallelism = 2
+
+[registry."registry:5000"]
+  http = true
+  insecure = true

package/compose/docker-compose.acme-dns.yml

@@ -0,0 +1,12 @@
+# =============================================================================
+# Overlay for a server whose certificates come by DNS-01 (acme_dns in its
+# vars.yml): lego, inside Traefik, reads the zone's token from a file. Added to
+# COMPOSE_FILE only there, so other servers' Traefik stays as it is.
+# =============================================================================
+
+services:
+  traefik:
+    environment:
+      HETZNER_API_TOKEN_FILE: /run/secrets/acme-dns-token
+    volumes:
+      - ./traefik/secrets:/run/secrets:ro

package/compose/docker-compose.ci.yml

@@ -0,0 +1,156 @@
+# =============================================================================
+# Platform CI overlay — Docker Registry + Jenkins (controller + agent)
+# App-agnostic: provides CI/CD infrastructure for any application.
+# Usage: docker compose -f docker-compose.yml -f docker-compose.ci.yml up
+# =============================================================================
+
+services:
+  registry:
+    image: registry:2.8.3
+    restart: unless-stopped
+    environment:
+      # registry-gc.sh deletes manifests nothing references any more.
+      - REGISTRY_STORAGE_DELETE_ENABLED=true
+    # No Traefik router: builds push to registry:5000 and the host daemon pulls
+    # from localhost:5000, so nothing outside the server needs it.
+    ports:
+      - "127.0.0.1:5000:5000"
+    volumes:
+      - registry-data:/var/lib/registry
+    networks:
+      - internal
+
+  # ---------------------------------------------------------------------------
+  # BuildKit — builds images without anyone holding the host's docker socket.
+  #
+  # The build agent used to mount /var/run/docker.sock read-write while running
+  # pipeline code checked out from arbitrary branches, which is host root by
+  # design rather than by exploit. Builds now go here instead: rootless, its own
+  # daemon, pushing straight to the registry. Compromising it gets you a
+  # container, not the box.
+  # ---------------------------------------------------------------------------
+  buildkitd:
+    image: moby/buildkit:v0.34.0-rootless
+    restart: unless-stopped
+    # Flags go in the command: this image does not read BUILDKITD_FLAGS (that
+    # is a buildx convention), and without them it listens on a unix socket
+    # the agent cannot reach.
+    command:
+      - --oci-worker-no-process-sandbox
+      - --addr
+      - tcp://0.0.0.0:1234
+    # rootlesskit needs an unprivileged user namespace, which Ubuntu 23.10+
+    # denies to unconfined processes. The named profile (installed by the docker
+    # role) grants userns to this container alone, so the host keeps the
+    # restriction.
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=buildkit-rootless
+    volumes:
+      - buildkit-cache:/home/user/.local/share/buildkit
+      - ./buildkit/buildkitd.toml:/home/user/.config/buildkit/buildkitd.toml:ro
+    mem_limit: 1g
+    networks:
+      - internal
+
+  jenkins-controller:
+    build:
+      context: ./jenkins
+      dockerfile: Dockerfile
+    # The controller runs as jenkins (uid/gid 1000) and reaches the socket via
+    # the host's docker group, whose GID differs per host.
+    group_add:
+      - ${DOCKER_GID:?}
+    restart: unless-stopped
+    # No COMPOSE_PROJECT_NAME here on purpose: every app's deploy runs
+    # `docker compose` from this container, and an exported project name would
+    # beat the one the deploy passes. APPS_DIR is where app .env files live.
+    environment:
+      - JENKINS_ADMIN_USER=${JENKINS_ADMIN_USER:-admin}
+      - JENKINS_ADMIN_PASSWORD=${JENKINS_ADMIN_PASSWORD:-admin}
+      - JENKINS_GIT_REPO=${GIT_REMOTE_URL:?}
+      - GITHUB_WEBHOOK_SECRET=${GITHUB_WEBHOOK_SECRET:-}
+      - DOMAIN=${DOMAIN:-localhost}
+      - APPS_DIR=${APPS_DIR:?}
+      - PLATFORM_REF=${PLATFORM_REF:?}
+      - PLATFORM_RENOVATE=${PLATFORM_RENOVATE:-false}
+      - RENOVATE_SCHEDULE=${RENOVATE_SCHEDULE:-H 4 * * 1}
+      - RENOVATE_PLATFORM=${RENOVATE_PLATFORM:-github}
+      - RENOVATE_ENDPOINT=${RENOVATE_ENDPOINT:-}
+      - RENOVATE_GIT_URL=${RENOVATE_GIT_URL:-}
+      - RENOVATE_GITHUB_COM_TOKEN=${RENOVATE_GITHUB_COM_TOKEN:-}
+      - RENOVATE_HOST_RULES=${RENOVATE_HOST_RULES:-}
+      - RENOVATE_REPOSITORIES=${RENOVATE_REPOSITORIES:-}
+      # Tell JCasC to merge every YAML in this directory at startup.
+      - CASC_JENKINS_CONFIG=/var/jenkins_home/casc
+    volumes:
+      - jenkins-home:/var/jenkins_home
+      # The controller is the only node with the docker socket, and it runs
+      # the deploy stage, so it needs the app's compose directory too.
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ${APPS_DIR:?}:${APPS_DIR:?}:ro
+      - ./jenkins/casc:/var/jenkins_home/casc:ro
+      # One directory per app, one file per secret; JCasC reads them with
+      # ${readFile:...}. Written by bin/jenkins-app-apply.
+      - ./jenkins-secrets:/run/app-secrets:ro
+      # GIT_TOKEN and RENOVATE_TOKEN, likewise: files, so a new one needs a
+      # reload, not a restart. Written by the platform role (or forgejo-config).
+      - ./platform-secrets:/run/platform-secrets:ro
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=platform-internal"
+      - "traefik.http.routers.jenkins.rule=Host(`jenkins.${DOMAIN:-localhost}`)"
+      - "traefik.http.routers.jenkins.entrypoints=websecure"
+      - "traefik.http.routers.jenkins.tls.certresolver=le"
+      - "traefik.http.routers.jenkins.middlewares=authelia@file"
+      - "traefik.http.routers.jenkins.service=jenkins"
+      # GitHub cannot log in; the plugin checks the payload's HMAC instead.
+      - "traefik.http.routers.jenkins-webhook.rule=Host(`jenkins.${DOMAIN:-localhost}`) && Path(`/github-webhook/`)"
+      - "traefik.http.routers.jenkins-webhook.entrypoints=websecure"
+      - "traefik.http.routers.jenkins-webhook.tls.certresolver=le"
+      - "traefik.http.routers.jenkins-webhook.priority=100"
+      - "traefik.http.routers.jenkins-webhook.service=jenkins"
+      - "traefik.http.services.jenkins.loadbalancer.server.port=8080"
+    networks:
+      - internal
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://127.0.0.1:8080/login"]
+      interval: 15s
+      timeout: 5s
+      retries: 10
+      start_period: 60s
+
+  jenkins-agent:
+    build:
+      context: ./jenkins-agent
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    # Written by the platform role once Jenkins is up; absent on first start,
+    # when the agent crash-loops until the role recreates it with the secret.
+    env_file:
+      - path: ./jenkins-agent.env
+        required: false
+    environment:
+      - JENKINS_URL=http://jenkins-controller:8080
+      - JENKINS_AGENT_NAME=builder
+      - JENKINS_AGENT_WORKDIR=/home/jenkins/agent
+      - DOMAIN=${DOMAIN:-localhost}
+      # Builds go to buildkitd, not to a docker daemon. This agent runs pipeline
+      # code from untrusted branches and deliberately has no docker socket.
+      - BUILDKIT_HOST=tcp://buildkitd:1234
+      - REGISTRY_PUSH_HOST=registry:5000
+    volumes:
+      - jenkins-agent-workdir:/home/jenkins/agent
+    networks:
+      - internal
+    depends_on:
+      jenkins-controller:
+        condition: service_healthy
+      buildkitd:
+        condition: service_started
+
+volumes:
+  registry-data:
+  buildkit-cache:
+  jenkins-home:
+  jenkins-agent-workdir:

package/compose/docker-compose.yml

@@ -0,0 +1,83 @@
+# =============================================================================
+# Platform base — Traefik reverse proxy + shared network
+# App-agnostic: knows nothing about what applications run on this platform.
+# =============================================================================
+
+services:
+  traefik:
+    image: traefik:v3.7.14
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
+      - ./traefik/dynamic:/etc/traefik/dynamic:ro
+      - ./traefik/certs:/certs:ro
+      - acme-data:/acme
+    networks:
+      - public
+      - internal
+    labels:
+      # The dashboard used to ride on an unauthenticated published :8080.
+      # It speaks no auth of its own, which is exactly what forwardAuth is for.
+      - "traefik.enable=true"
+      - "traefik.http.routers.dashboard.rule=Host(`traefik.${DOMAIN:-localhost}`)"
+      - "traefik.http.routers.dashboard.entrypoints=websecure"
+      - "traefik.http.routers.dashboard.tls.certresolver=le"
+      - "traefik.http.routers.dashboard.service=api@internal"
+      - "traefik.http.routers.dashboard.middlewares=authelia@file,security-headers@file"
+
+  # ---------------------------------------------------------------------------
+  # Authelia — single sign-on for services that sit behind Traefik.
+  #
+  # Deliberately NOT behind its own authelia@file middleware: that would be an
+  # infinite redirect. The portal has to stay reachable to authenticate anyone.
+  # ---------------------------------------------------------------------------
+  authelia:
+    image: authelia/authelia:4.39.28
+    restart: unless-stopped
+    environment:
+      - X_AUTHELIA_CONFIG=/config/configuration.yml
+      # Authelia does not expand ${VAR}; this filter is what makes
+      # {{ env "DOMAIN" }} work inside configuration.yml.
+      - X_AUTHELIA_CONFIG_FILTERS=template
+      - DOMAIN=${DOMAIN:-localhost}
+      - AUTH_POLICY=${AUTH_POLICY:-two_factor}
+      - AUTHELIA_SESSION_SECRET_FILE=/config/secrets/session
+      - AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE=/config/secrets/storage_encryption
+      # Empty in dev, which falls the notifier back to a file — see
+      # configuration.yml. The SMTP password is NOT an env var; it is read from
+      # /config/secrets/smtp_password by the config template.
+      - SMTP_ADDRESS=${AUTHELIA_SMTP_ADDRESS:-}
+      - SMTP_USERNAME=${AUTHELIA_SMTP_USERNAME:-}
+      - SMTP_SENDER=${AUTHELIA_SMTP_SENDER:-}
+    volumes:
+      - ./authelia:/config:ro
+      - authelia-data:/data
+    mem_limit: 128m
+    networks:
+      - internal
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=platform-internal"
+      - "traefik.http.routers.authelia.rule=Host(`auth.${DOMAIN:-localhost}`)"
+      - "traefik.http.routers.authelia.entrypoints=websecure"
+      - "traefik.http.routers.authelia.tls.certresolver=le"
+      - "traefik.http.services.authelia.loadbalancer.server.port=9091"
+
+# Two networks, so an app can reach Traefik's routes and nothing else of the
+# platform. Apps join platform-public; the platform's own services live on
+# platform-internal, where only Traefik joins them.
+networks:
+  public:
+    name: platform-public
+  internal:
+    name: platform-internal
+
+volumes:
+  acme-data:
+  # Passkeys live here. Losing this volume means every credential is gone and
+  # everyone re-enrols — back it up.
+  authelia-data:

package/compose/jenkins/Dockerfile

@@ -0,0 +1,40 @@
+# =============================================================================
+# Jenkins Controller — LTS with Docker CLI, Compose, buildctl and JCasC
+# =============================================================================
+
+FROM jenkins/jenkins:2.580.1-lts-jdk21
+
+USER root
+
+# renovate: datasource=github-releases depName=moby/buildkit
+ARG BUILDKIT_VERSION=v0.34.0
+
+# Install Docker CLI + Compose plugin
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      ca-certificates curl gnupg jq && \
+    install -m 0755 -d /etc/apt/keyrings && \
+    curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg && \
+    chmod a+r /etc/apt/keyrings/docker.gpg && \
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
+      https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
+      > /etc/apt/sources.list.d/docker.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends \
+      docker-ce-cli docker-compose-plugin && \
+    arch="$(dpkg --print-architecture)" && \
+    curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
+      | tar -xz -C /usr/local bin/buildctl && \
+    rm -rf /var/lib/apt/lists/*
+
+USER jenkins
+
+# Install plugins
+COPY plugins.txt /usr/share/jenkins/ref/plugins.txt
+RUN jenkins-plugin-cli --plugin-file /usr/share/jenkins/ref/plugins.txt
+
+# JCasC fragments are bind-mounted, not baked in; CASC_JENKINS_CONFIG is set in
+# compose. That keeps config out of the image and out of the jenkins-home volume.
+# notifyCommit without a token, but only to trigger polling: how Forgejo tells
+# Jenkins about a push, over platform-internal (Traefik does not route it).
+ENV JAVA_OPTS="-Djenkins.install.runSetupWizard=false -Dhudson.plugins.git.GitStatus.NOTIFY_COMMIT_ACCESS_CONTROL=disabled-for-polling"

package/compose/jenkins/casc/00-platform.yaml

@@ -0,0 +1,158 @@
+# =============================================================================
+# Jenkins Configuration as Code — platform fragment (app-agnostic).
+#
+# Owns:
+#   - Jenkins setup, security realm, authorization
+#   - The agent node
+#   - Git credentials (for cloning the app repo)
+#   - GitHub: push-webhook secret + API token for commit statuses
+#   - Jenkins URL
+#
+# Also owns the app-agnostic jobs: platform-registry-gc and rollback work off
+# the release records every app's <app>/deploy job writes (the platform
+# library's appDeploy) and start that job with a REF. platform-renovate exists
+# only where the server has repos to keep up to date (PLATFORM_RENOVATE).
+#
+# Does NOT own any app-specific credentials (Postgres, ...) or app pipelines.
+# Each app renders its own 10-<app>.yaml next to this file and applies it with
+# bin/jenkins-app-apply. JCasC merges every YAML in this directory.
+#
+# Git remote comes from the platform .env (rendered by Ansible).
+# =============================================================================
+
+jenkins:
+  systemMessage: "Platform CI/CD — Managed by JCasC"
+  numExecutors: 1
+
+  securityRealm:
+    local:
+      allowsSignup: false
+      users:
+        - id: "${JENKINS_ADMIN_USER:-admin}"
+          password: "${JENKINS_ADMIN_PASSWORD:-admin}"
+
+  authorizationStrategy:
+    loggedInUsersCanDoAnything:
+      allowAnonymousRead: false
+
+  nodes:
+    - permanent:
+        name: "builder"
+        labelString: "buildkit linux"
+        numExecutors: 2
+        remoteFS: "/home/jenkins/agent"
+        launcher:
+          inbound:
+            workDirSettings:
+              disabled: false
+              internalDir: "remoting"
+        retentionStrategy: "always"
+
+credentials:
+  system:
+    domainCredentials:
+      - credentials:
+          - usernamePassword:
+              scope: GLOBAL
+              id: "git-credentials"
+              description: "Git credentials for cloning repositories"
+              username: "git"
+              password: "${readFile:/run/platform-secrets/GIT_TOKEN}"
+          - string:
+              scope: GLOBAL
+              id: "github-token"
+              description: "Same PAT as git-credentials; needs Commit statuses: write"
+              secret: "${readFile:/run/platform-secrets/GIT_TOKEN}"
+          - string:
+              scope: GLOBAL
+              id: "renovate-token"
+              description: "PAT for Renovate: Contents + Pull requests read & write"
+              secret: "${readFile:/run/platform-secrets/RENOVATE_TOKEN}"
+          - string:
+              scope: GLOBAL
+              id: "github-webhook-secret"
+              description: "HMAC secret GitHub signs push webhooks with"
+              secret: "${GITHUB_WEBHOOK_SECRET:-}"
+
+unclassified:
+  # The pipeline every app runs. Trusted (outside the sandbox), loaded from
+  # PLATFORM_REF (the release tag, v<version>; a test server may set a branch) and jobs cannot
+  # pick another version, so a pushed app branch never changes what a pipeline
+  # does. See ci/jenkins-lib/.
+  globalLibraries:
+    libraries:
+      - name: "platform"
+        defaultVersion: "${PLATFORM_REF}"
+        allowVersionOverride: false
+        implicit: false
+        retriever:
+          modernSCM:
+            libraryPath: "ci/jenkins-lib/"
+            scm:
+              git:
+                remote: "${JENKINS_GIT_REPO}"
+                credentialsId: "git-credentials"
+  location:
+    url: "https://jenkins.${DOMAIN:-localhost}/"
+  # Webhook lands on /github-webhook/. Hooks are registered by hand in the
+  # repo settings, not managed from here.
+  gitHubPluginConfig:
+    configs:
+      - name: "GitHub"
+        apiUrl: "https://api.github.com"
+        credentialsId: "github-token"
+        manageHooks: false
+    hookSecretConfigs:
+      - credentialsId: "github-webhook-secret"
+
+# Platform jobs run pipelines from PLATFORM_REF of this repo, never from a pushed branch.
+jobs:
+  - script: |
+      def fromPlatform = { String path ->
+        return {
+          cpsScm {
+            scm {
+              git {
+                remote {
+                  url("${JENKINS_GIT_REPO}")
+                  credentials("git-credentials")
+                }
+                branch("${PLATFORM_REF}")
+              }
+            }
+            scriptPath(path)
+            lightweight(false)
+          }
+        }
+      }
+
+      pipelineJob("platform-registry-gc") {
+        displayName("Platform Registry GC")
+        description("Nightly: deletes registry images no recent release of any app references, then prunes the BuildKit cache and host images. See ci/registry-gc.sh.")
+        definition(fromPlatform("ci/registry-gc.Jenkinsfile"))
+        triggers {
+          cron("H 3 * * *")
+        }
+      }
+
+      pipelineJob("rollback") {
+        displayName("Rollback")
+        description("Redeploys an earlier release of an app: pick the app, pick a release, done. Hands the SHA to <app>/deploy.")
+        definition(fromPlatform("ci/rollback.Jenkinsfile"))
+      }
+
+      if ("${PLATFORM_RENOVATE:-false}" == "true") {
+        pipelineJob("platform-renovate") {
+          displayName("Platform Renovate")
+          description("On renovate_schedule (weekly by default): opens PRs that bump pinned versions. Config: renovate.json. See ci/renovate.Jenkinsfile.")
+          // Declared here as well: a JCasC reload regenerates the job and drops
+          // parameters only the pipeline declares.
+          parameters {
+            booleanParam("DRY_RUN", false, "Log what would change, open no PRs")
+          }
+          definition(fromPlatform("ci/renovate.Jenkinsfile"))
+          triggers {
+            cron("${RENOVATE_SCHEDULE:-H 4 * * 1}")
+          }
+        }
+      }