Add forgejo-admin-api-token catalog lane (CCR-2026-0006)
Draft routing entry and worker playbook for Forgejo site-admin PAT custody in OpenBao. Workplan WARDEN-WP-0025 tracks approval, apply, and verification.
This commit is contained in:
parent
48b21ab85c
commit
fd231fac0d
3 changed files with 240 additions and 0 deletions
|
|
@ -279,6 +279,23 @@ entries:
|
|||
exec_capable: true
|
||||
lane: secret
|
||||
|
||||
- id: forgejo-admin-api-token
|
||||
title: Forgejo operator/admin API token (PAT)
|
||||
need_keywords: [forgejo, admin, pat, package, prune, FORGEJO_ADMIN_TOKEN, forgejo-package-prune, forgejo-tegwick, webhook, npm]
|
||||
owner_repo: railiance-platform
|
||||
subsystem: OpenBao + Forgejo
|
||||
warden_executes: false
|
||||
wiki_ref: wiki/playbooks/forgejo-admin-api-token.md#worker-checklist
|
||||
canon_ref: railiance-platform/docs/workload-kv-access-lanes.md
|
||||
reviewed: "2026-07-12"
|
||||
status: draft
|
||||
# CCR-2026-0006 proposed 2026-07-12; policy apply + PAT provision pending platform-operator approval.
|
||||
auth_method: "caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)"
|
||||
path_template: "platform/workloads/forgejo/forgejo-admin"
|
||||
fetch_command: "bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin"
|
||||
exec_capable: true
|
||||
lane: secret
|
||||
|
||||
# --- draft: owner path not yet shipped; hidden from default lookup ---
|
||||
|
||||
- id: object-storage-sts
|
||||
|
|
|
|||
117
wiki/playbooks/forgejo-admin-api-token.md
Normal file
117
wiki/playbooks/forgejo-admin-api-token.md
Normal file
|
|
@ -0,0 +1,117 @@
|
|||
# Forgejo Admin API Token (PAT)
|
||||
|
||||
Date: 2026-07-12
|
||||
Catalog: `forgejo-admin-api-token` (status `draft`, `resolvable: false` until verified)
|
||||
Owner: `railiance-platform` (CCR-2026-0006)
|
||||
|
||||
Forgejo site-admin personal access token for operator and automation tooling.
|
||||
Sibling to `forgejo-mailer` (SMTP via ESO); phase 1 is workstation + activity-core
|
||||
worker fetch only — no cluster ExternalSecret delivery.
|
||||
|
||||
---
|
||||
|
||||
## OpenBao pointers
|
||||
|
||||
| Field | Value |
|
||||
| --- | --- |
|
||||
| Mount | `platform` |
|
||||
| Path | `platform/workloads/forgejo/forgejo-admin` |
|
||||
| Secret field | `API_TOKEN` (PAT value) |
|
||||
| Metadata fields | `API_USER`, `API_BASE_URL`, `TOKEN_SCOPES`, `GENERATED_AT` (optional, non-secret) |
|
||||
| Policy | `workload-kv-read-forgejo-admin` |
|
||||
| OIDC role | `forgejo-admin-workload-kv-read` (`groups=net-kingdom-admins`) |
|
||||
|
||||
**PAT scopes (minimum for current consumers):** `read:package`, `write:package`,
|
||||
`read:repository`, `write:repository`, plus admin scopes as needed for
|
||||
`forgejo-operator-bootstrap` (mirror the current admin PAT).
|
||||
|
||||
**Forgejo account:** `tegwick` (site admin, `coulomb` Owners).
|
||||
|
||||
---
|
||||
|
||||
## Worker checklist
|
||||
|
||||
1. **Login** (caller identity — ops-warden adds no credential):
|
||||
|
||||
```bash
|
||||
bao login -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read
|
||||
```
|
||||
|
||||
2. **Export for a Forgejo API run** (value streams to your shell — never paste into chat):
|
||||
|
||||
```bash
|
||||
export FORGEJO_ADMIN_TOKEN=$(
|
||||
bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin
|
||||
)
|
||||
```
|
||||
|
||||
3. **Or proxy via warden access** (after catalog promotion):
|
||||
|
||||
```bash
|
||||
warden access forgejo-admin-api-token --no-policy --fetch --field API_TOKEN
|
||||
```
|
||||
|
||||
4. **Run consumers**:
|
||||
|
||||
```bash
|
||||
# Package prune (railiance-platform)
|
||||
make forgejo-package-prune-dry-run
|
||||
make forgejo-package-prune
|
||||
|
||||
# Operator bootstrap / npm smoke / reuse webhook (railiance-apps)
|
||||
make forgejo-operator-bootstrap
|
||||
make forgejo-npm-smoke
|
||||
make reuse-forgejo-webhook
|
||||
```
|
||||
|
||||
5. **Retire workstation file drop** once downstream `load_token()` paths read
|
||||
OpenBao when env is unset:
|
||||
|
||||
- `/tmp/forgejo-tegwick-api-token` — legacy; do not use as steady state
|
||||
- `FORGEJO_ADMIN_TOKEN` env — acceptable for one-off sessions after fetch
|
||||
|
||||
---
|
||||
|
||||
## Operator provisioning (attended)
|
||||
|
||||
After CCR approval and policy apply:
|
||||
|
||||
1. Forgejo UI: `tegwick` → Settings → Applications → Generate New Token
|
||||
2. Store in OpenBao (do not echo the value):
|
||||
|
||||
```bash
|
||||
bao kv put platform/workloads/forgejo/forgejo-admin \
|
||||
API_TOKEN=@/path/to/pat-file \
|
||||
API_USER=tegwick \
|
||||
API_BASE_URL=https://forgejo.coulomb.social \
|
||||
TOKEN_SCOPES='read:package,write:package,read:repository,write:repository' \
|
||||
GENERATED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
||||
```
|
||||
|
||||
3. Verify field presence without printing values:
|
||||
|
||||
```bash
|
||||
bao kv metadata get platform/workloads/forgejo/forgejo-admin
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Consumers (downstream wiring — after lane verified)
|
||||
|
||||
| Consumer | Repo |
|
||||
| --- | --- |
|
||||
| `tools/cmd/forgejo-package-prune` | `railiance-platform` |
|
||||
| `weekly-forgejo-package-prune` activity | `activity-core` |
|
||||
| `forgejo-operator-bootstrap`, `forgejo-npm-smoke`, `reuse-forgejo-webhook` | `railiance-apps` |
|
||||
|
||||
Docs: `railiance-platform/docs/forgejo-package-prune.md`,
|
||||
`railiance-apps/docs/forgejo-on-railiance01.md`.
|
||||
|
||||
---
|
||||
|
||||
## See also
|
||||
|
||||
- `railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml`
|
||||
- `railiance-platform/openbao/policies/workload-kv-read-forgejo-admin.hcl`
|
||||
- `wiki/playbooks/railiance-backup-offsite-lane.md` (OIDC workstation read pattern)
|
||||
- `forgejo-mailer` lane — SMTP only; unchanged
|
||||
106
workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md
Normal file
106
workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md
Normal file
|
|
@ -0,0 +1,106 @@
|
|||
---
|
||||
id: WARDEN-WP-0025
|
||||
type: workplan
|
||||
title: "Forgejo admin PAT OpenBao lane (CCR-2026-0006)"
|
||||
domain: infotech
|
||||
repo: ops-warden
|
||||
status: active
|
||||
owner: grok
|
||||
topic_slug: custodian
|
||||
planning_priority: high
|
||||
planning_order: 25
|
||||
created: "2026-07-12"
|
||||
updated: "2026-07-12"
|
||||
---
|
||||
|
||||
# WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane
|
||||
|
||||
**Trigger:** the-custodian CCR request (msg `54125f84`) — establish OpenBao custody
|
||||
for the Forgejo site-admin PAT at `platform/workloads/forgejo/forgejo-admin`.
|
||||
Drivers: `ACTIVITY-WP-0020` weekly package prune and railiance-apps/platform tools
|
||||
still using `/tmp/forgejo-tegwick-api-token` or `FORGEJO_ADMIN_TOKEN`.
|
||||
|
||||
**Boundary:** ops-warden holds no PAT; workstation OIDC fetch mirrors
|
||||
`railiance-backup-offsite-lane` (CCR-2026-0004). Distinct from `forgejo-mailer`
|
||||
(SMTP via ESO). Phase 1: no cluster ExternalSecret.
|
||||
|
||||
**Depends on:** platform-operator approval of CCR-2026-0006; attended PAT mint.
|
||||
|
||||
---
|
||||
|
||||
## Tasks
|
||||
|
||||
### T1 — Draft CCR + policy metadata
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0025-T01
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
- [x] `CCR-2026-0006-forgejo-admin-api-token-lane.yaml` (`status: proposed`)
|
||||
- [x] `openbao/policies/workload-kv-read-forgejo-admin.hcl`
|
||||
- [x] `docs/workload-kv-access-lanes.md` section
|
||||
|
||||
### T2 — ops-warden catalog + playbook
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0025-T02
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
- [x] Catalog entry `forgejo-admin-api-token` (`status: draft`)
|
||||
- [x] `wiki/playbooks/forgejo-admin-api-token.md`
|
||||
|
||||
### T3 — Platform-operator approval + metadata apply
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0025-T03
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
- [ ] CCR approved by platform-operator
|
||||
- [ ] `scripts/credential-change.py applier-dry-run CCR-2026-0006`
|
||||
- [ ] Policy `workload-kv-read-forgejo-admin` + OIDC role `forgejo-admin-workload-kv-read` applied on `bao.coulomb.social`
|
||||
- [ ] Non-secret `delegated_metadata_apply` evidence on CCR
|
||||
|
||||
### T4 — Attended PAT provision + verification
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0025-T04
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
- [ ] Mint PAT as Forgejo user `tegwick` (attended)
|
||||
- [ ] `bao kv put platform/workloads/forgejo/forgejo-admin` (API_TOKEN + metadata)
|
||||
- [ ] Positive fetch after OIDC login; negative default-policy denial
|
||||
- [ ] `warden route find "forgejo admin pat"` resolves; promote catalog to `active` when verified
|
||||
|
||||
### T5 — Notify downstream consumers
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0025-T05
|
||||
status: wait
|
||||
priority: medium
|
||||
```
|
||||
|
||||
- [ ] Ack the-custodian with CCR id + catalog id (no secret values)
|
||||
- [ ] Signal railiance-platform / activity-core / railiance-apps to wire `load_token()` OpenBao paths
|
||||
|
||||
---
|
||||
|
||||
## Acceptance
|
||||
|
||||
- CCR-2026-0006 approved, policy + OIDC role live, PAT in OpenBao
|
||||
- `warden route find "forgejo admin pat"` → `forgejo-admin-api-token`
|
||||
- No PAT in Git, State Hub, workplans, logs, or chat
|
||||
- Workstation file drop retired as steady-state path after downstream wiring
|
||||
|
||||
## See also
|
||||
|
||||
- `railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml`
|
||||
- `activity-core/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md`
|
||||
- Custodian message `54125f84-e9df-4fa0-9309-7370633a20d3`
|
||||
Loading…
Add table
Add a link
Reference in a new issue