v1.4.0 — macOS / Colima support + hands-off bootstrap

Highlights

Fully hands-off bootstrap on macOS (Apple Silicon + Intel) via Colima. git clone && ./bootstrap.sh now succeeds on a fresh machine with no manual .env edits, no TTY required for sudo (GUI admin prompt fallback), and no hard-coded secrets leaking into the landing-zone git history.

The BankOffer + CareerForge test workloads have been extracted to the sibling repo my-testing-apps so this repo is a clean base platform.

Quick start

macOS (Intel or Apple Silicon)

brew install colima docker docker-compose git
colima start --cpu 6 --memory 10 --disk 60
git clone https://github.com/bogdandragosvasile/gitops-landing-zone.git
cd gitops-landing-zone
./bootstrap.sh

Linux / WSL2

git clone https://github.com/bogdandragosvasile/gitops-landing-zone.git
cd gitops-landing-zone
./bootstrap.sh

Windows 11

Same as before — from an elevated PowerShell: .\bootstrap.ps1.

What's new

Added

• macOS + Apple Silicon support via Colima, with platform/arch auto-detection.
• bootstrap.sh / teardown.sh top-level unix entry points.
• scripts/gen-env.sh — renders .env with URL-safe random secrets on first bootstrap.
• scripts/01b-ensure-certs.sh — auto-generates Vaultwarden TLS certs.
• Colima VM sysctl tuning (fs.inotify.max_user_watches=524288) to prevent Promtail too many open files.
• k3d-node DNS patch on macOS (Colima's internal resolver is unreachable from the nested bridge).
• allow-intra-keycloak-http and allow-traefik-prometheus-ingress NetworkPolicies.
• Bcrypt-based offline ArgoCD admin password rotation.
• docs/ADD_YOUR_APP.md + gitops-repo/apps-examples/my-app.yaml.example.
• README "Platform-specific notes" + "Tested platforms" sections.

Changed

• BankOffer + CareerForge extracted to my-testing-apps.
• scripts/07-push-gitops-repo.sh renders into a temp dir, leaving the source tree as ${VAR} templates (secrets no longer leak into git history).
• scripts/10-configure-oidc.sh explicitly applies the keycloak-configure Job with the proper envsubst whitelist instead of hoping the PostSync hook runs.
• scripts/02-start-gitea.sh also brings up vaultwarden + dnsmasq.
• scripts/setup-hosts.sh falls back to osascript with administrator privileges on macOS when no TTY.
• Fixed metallb allow-apiserver-webhook pod-selector labels (matched nothing on the current chart → every IPAddressPool apply returned 502).

Fixed

• Password auth failures when .env passwords contained + (form-urlencoded decoded as space).
• keycloak-postgres-secret hardcoded password ignoring .env regeneration.
• Top-level bootstrap.sh no longer hard-fails when .env is missing — it triggers gen-env.sh automatically.
• scripts/09b-build-portal.sh import bug (ctr -n k8s.io images import + correct k3d node filter).

Tested

Host	Status
macOS 14 + Colima (M1 Pro, 16 GB)	✅ End-to-end verified
Ubuntu 22.04 + Docker Engine	✅ Supported (same scripts)
WSL2 + Docker Desktop	✅ Supported (same scripts)
Windows 11 + Docker Desktop	✅ Supported (bootstrap.ps1)

Full changelog

See CHANGELOG.md.