phase 8: forgejo sync config, authentik-ldap SSO service, runbook update

RUNBOOK.md

@@ -1379,3 +1379,80 @@ kscloud1 (Hetzner) is planned to be replaced by an Oracle Cloud VPS. When the ne
 | `cloudflared/docker-compose.yml` | `TUNNEL_TOKEN` (inline) |
 
 Do not commit `.env` files, webhook URLs, or database files to this repo.
+
+---
+
+## Phase 8: Forgejo Sync + osTicket Authentik LDAP SSO (2026-06-14/15)
+
+### Forgejo Sync (monk → kscloud1)
+
+Monk is authoritative. kscloud1 Forgejo is a read replica synced every 6 hours.
+
+**Sync script:** `~/kitestacks-live/docker/forgejo/sync-to-cloud.sh`
+**Cron:** `0 */6 * * *` on monk, logs to `/tmp/forgejo-sync.log`
+
+Manual sync:
+```bash
+~/kitestacks-live/docker/forgejo/sync-to-cloud.sh
+```
+
+To re-do a full restore from scratch (e.g., after kscloud1 rebuild):
+```bash
+# On monk: create dump
+docker exec -u git forgejo /app/gitea/gitea dump --type zip -f /tmp/forgejo-backup.zip
+docker cp forgejo:/tmp/forgejo-backup.zip /tmp/forgejo-backup.zip
+# Transfer and restore on cloud host — see claude-memory for detailed steps
+```
+
+### osTicket Authentik LDAP SSO
+
+Staff log into `tasks.kitestacks.com/scp/` using their **Authentik credentials** (not a separate osTicket password).
+
+**Architecture:**
+```
+osticket-app → authentik-ldap-proxy:389 (socat) → authentik-ldap:3389 → auth.kitestacks.com
+```
+
+**Services deployed:**
+- `~/kitestacks-live/docker/authentik-ldap/` — LDAP outpost + socat proxy on monk
+- `/opt/kitestacks/docker/authentik-ldap/` — LDAP outpost on kscloud1
+
+**LDAP search account:** `cn=ldap-svc,ou=users,dc=ldap,dc=goauthentik,dc=io`
+Password stored in Authentik and in osTicket's `ost_config` (namespace `plugin.2`, key `bind_pw`, encrypted).
+
+**auth-ldap.phar** at `/data/upload/include/plugins/auth-ldap.phar` inside the osticket-app container has been patched (original at `.phar.orig`). Do NOT replace it with the upstream version — the patch is required for PHP 7.3 + PEAR compatibility.
+
+**If LDAP login stops working:**
+```bash
+# Check LDAP outpost is running and connected
+docker logs authentik-ldap --since 5m | grep -v debug
+docker logs authentik-ldap-proxy 2>&1 | tail -5
+
+# Test bind from osticket-app container
+docker exec osticket-app php -r "
+  \$c = @ldap_connect('authentik-ldap-proxy');
+  ldap_set_option(\$c, LDAP_OPT_PROTOCOL_VERSION, 3);
+  \$r = @ldap_bind(\$c, 'cn=ldap-svc,ou=users,dc=ldap,dc=goauthentik,dc=io', 'PASSWORD');
+  echo \$r ? 'OK' : ldap_error(\$c);
+"
+# Verify kscloud1 outpost reachable
+nc -zv 100.123.254.52 3389
+```
+
+**Reset a staff member's Authentik password:**
+```bash
+docker exec authentik ak shell -c "
+from authentik.core.models import User
+u = User.objects.get(username='kenpat7177')
+u.set_password('NewPassword123!')
+u.save()
+print('done')
+"
+```
+
+**Clear osTicket login lockout:**
+```bash
+docker run --rm --network host mariadb:10.11 mysql \
+  -h 100.123.254.52 -u osticket -p<DB_PASS> osticket \
+  -e "DELETE FROM ost_session;"
+```