Use Gitea repository guidance and retain Alloy security regression check [skip ci]

README.md

@@ -10,12 +10,12 @@ Local infrastructure operations for independently owned nodes, with a Python sta
 
 - **Live Documentation**: <https://docs.ermnvldmr.com/en/apex/> (also available in [Russian](https://docs.ermnvldmr.com/ru/apex/))
 - **Getting Started Guide**: <https://docs.ermnvldmr.com/en/apex/getting-started/>
-- **Report an Issue**: <https://github.com/deytenit/apex.ermnvldmr.com/issues>
+- **Report an Issue**: <https://git.ermnvldmr.com/deytenit/apex.ermnvldmr.com/issues>
 - **License**: [BSD-2-Clause](#copyright--license)
 
 ```sh
 # Clone your node's repository (which pins apex as commons/)
-git clone --recurse-submodules git@github.com:you/selfhost.example.com.git
+git clone --recurse-submodules ssh://git@git.example.com:22222/infrastructure/selfhost.example.com.git
 cd selfhost.example.com && ./init.sh && source ~/.bashrc
 
 # Configure node identity
@@ -138,7 +138,7 @@ Adding shared actions or improving the engine.
 
 ## Communication & Support
 
-- **Issues**: <https://github.com/deytenit/apex.ermnvldmr.com/issues>
+- **Issues**: <https://git.ermnvldmr.com/deytenit/apex.ermnvldmr.com/issues>
 - **Email**: <personal@ermnvldmr.com>
 
 ## Copyright & License

actions/backup/run.py

@@ -1,5 +1,5 @@
 # actions/backup/run.py
-"""Label-driven restic backup via resticontainer (github.com/deytenit/resticontainer).
+"""Label-driven restic backup via resticontainer (git.ermnvldmr.com/deytenit/resticontainer).
 Runs the resticontainer core service one-shot: init-if-needed -> backup (discovers
 `restic.*`-labelled services, runs their pre-hooks/stops, snapshots the union of the
 resolved host paths in a single restic run) -> forget --prune -> Telegram. Every

ci/cloud-init/user-data.template.yaml

@@ -19,7 +19,7 @@ write_files:
     permissions: '0600'
     content: |
       APEX_REPO_NAME="node1.example.com"
-      APEX_REPO_URL="https://github.com/you/node1.example.com.git"
+      APEX_REPO_URL="https://git.example.com/infrastructure/node1.example.com.git"
       APEX_TIER1_MODE="directory"
       APEX_TIER1_DEVICE=""
       APEX_TIER2_MODE="directory"

tests/test_configure_alloy.py

@@ -29,7 +29,7 @@ class NativeAlloy(unittest.TestCase):
         self.ctx.sys.sudo.assert_not_called()
 
     def test_invalid_role_or_environment_path_cannot_change_service(self):
-        for role, path in [('unknown', '/etc/alloy/secrets'), ('host', '/tmp/file\nUser=root')]:
+        for role, path in [('unknown', '/etc/alloy/secrets'), ('host', '/etc/alloy/invalid\nUser=root')]:
             self.configure(role=role, environment_file=path)
             with self.assertRaises(ValueError):
                 alloy.run(self.ctx, SimpleNamespace(dry_run=False))