tegwick
e2b5fa1442
config.Load uses the variable when lldap.bindPW is empty, accepts equal values (migration, logged as redundant) and refuses differing values with an error that names neither. check-config and identity-facts report the source, never the value. For net-kingdom NK-WP-0056-T04 (ESO-delivered svc-keycape bind). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
1.8 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | flavor | depends_on |
|---|---|---|---|---|---|---|---|---|---|---|---|
| KEY-WP-0046 | workplan | Directory bind password from the environment (KEYCAPE_LLDAP_BIND_PW) | infotech | key-cape | active | claude-code | custodian | 2026-10-31 | 2026-10-31 | extension |
Accepted from net-kingdom NK-WP-0056-T04 (founder decision 2026-10-31: environment override, implemented by
claude-code in this repository). NetKingdom moves the LLDAP service binds from personal custody into OpenBao,
delivered by ESO. KeyCape reads lldap.bindPW only from config.yaml inside the keycape-config Secret, so
ESO cannot own that one value. With an environment override the bind is delivered from a dedicated Secret
key, as client secrets already are (secretRef: env:...).
Accept KEYCAPE_LLDAP_BIND_PW in config.Load
id: KEY-WP-0046-T01
status: done
priority: high
config.Load applies KEYCAPE_LLDAP_BIND_PW (the name lldap-export already reads): used when bindPW is
empty; accepted with a warning when equal to bindPW (migration state); startup refused when they differ,
with an error that names neither value. Config.LLDAPBindPWSource records the source; check-config reports
lldap_bind_pw_source and identity-facts reports password_source. Tests in
src/internal/config/config_test.go; docs/operations.md documents the variable.
Done when: the change is merged with tests and go vet/go test ./... pass.
Image through the owner pipeline
id: KEY-WP-0046-T02
status: todo
priority: high
The Forgejo workflow builds the image from main. Record the digest here and in net-kingdom NK-WP-0056-T04;
net-kingdom pins it in sso-mfa/k8s/keycape/deployment.yaml together with the new environment entry.
Done when: an image built from a commit containing T01 is published, and its digest is recorded.