diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml index a45829f..07ff46f 100644 --- a/registry/routing/catalog.yaml +++ b/registry/routing/catalog.yaml @@ -279,6 +279,23 @@ entries: exec_capable: true lane: secret + - id: forgejo-admin-api-token + title: Forgejo operator/admin API token (PAT) + need_keywords: [forgejo, admin, pat, package, prune, FORGEJO_ADMIN_TOKEN, forgejo-package-prune, forgejo-tegwick, webhook, npm] + owner_repo: railiance-platform + subsystem: OpenBao + Forgejo + warden_executes: false + wiki_ref: wiki/playbooks/forgejo-admin-api-token.md#worker-checklist + canon_ref: railiance-platform/docs/workload-kv-access-lanes.md + reviewed: "2026-07-12" + status: draft + # CCR-2026-0006 proposed 2026-07-12; policy apply + PAT provision pending platform-operator approval. + auth_method: "caller's own OpenBao token (OIDC netkingdom role forgejo-admin-workload-kv-read)" + path_template: "platform/workloads/forgejo/forgejo-admin" + fetch_command: "bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin" + exec_capable: true + lane: secret + # --- draft: owner path not yet shipped; hidden from default lookup --- - id: object-storage-sts diff --git a/wiki/playbooks/forgejo-admin-api-token.md b/wiki/playbooks/forgejo-admin-api-token.md new file mode 100644 index 0000000..b30dd3d --- /dev/null +++ b/wiki/playbooks/forgejo-admin-api-token.md @@ -0,0 +1,117 @@ +# Forgejo Admin API Token (PAT) + +Date: 2026-07-12 +Catalog: `forgejo-admin-api-token` (status `draft`, `resolvable: false` until verified) +Owner: `railiance-platform` (CCR-2026-0006) + +Forgejo site-admin personal access token for operator and automation tooling. +Sibling to `forgejo-mailer` (SMTP via ESO); phase 1 is workstation + activity-core +worker fetch only — no cluster ExternalSecret delivery. + +--- + +## OpenBao pointers + +| Field | Value | +| --- | --- | +| Mount | `platform` | +| Path | `platform/workloads/forgejo/forgejo-admin` | +| Secret field | `API_TOKEN` (PAT value) | +| Metadata fields | `API_USER`, `API_BASE_URL`, `TOKEN_SCOPES`, `GENERATED_AT` (optional, non-secret) | +| Policy | `workload-kv-read-forgejo-admin` | +| OIDC role | `forgejo-admin-workload-kv-read` (`groups=net-kingdom-admins`) | + +**PAT scopes (minimum for current consumers):** `read:package`, `write:package`, +`read:repository`, `write:repository`, plus admin scopes as needed for +`forgejo-operator-bootstrap` (mirror the current admin PAT). + +**Forgejo account:** `tegwick` (site admin, `coulomb` Owners). + +--- + +## Worker checklist + +1. **Login** (caller identity — ops-warden adds no credential): + + ```bash + bao login -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read + ``` + +2. **Export for a Forgejo API run** (value streams to your shell — never paste into chat): + + ```bash + export FORGEJO_ADMIN_TOKEN=$( + bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin + ) + ``` + +3. **Or proxy via warden access** (after catalog promotion): + + ```bash + warden access forgejo-admin-api-token --no-policy --fetch --field API_TOKEN + ``` + +4. **Run consumers**: + + ```bash + # Package prune (railiance-platform) + make forgejo-package-prune-dry-run + make forgejo-package-prune + + # Operator bootstrap / npm smoke / reuse webhook (railiance-apps) + make forgejo-operator-bootstrap + make forgejo-npm-smoke + make reuse-forgejo-webhook + ``` + +5. **Retire workstation file drop** once downstream `load_token()` paths read + OpenBao when env is unset: + + - `/tmp/forgejo-tegwick-api-token` — legacy; do not use as steady state + - `FORGEJO_ADMIN_TOKEN` env — acceptable for one-off sessions after fetch + +--- + +## Operator provisioning (attended) + +After CCR approval and policy apply: + +1. Forgejo UI: `tegwick` → Settings → Applications → Generate New Token +2. Store in OpenBao (do not echo the value): + + ```bash + bao kv put platform/workloads/forgejo/forgejo-admin \ + API_TOKEN=@/path/to/pat-file \ + API_USER=tegwick \ + API_BASE_URL=https://forgejo.coulomb.social \ + TOKEN_SCOPES='read:package,write:package,read:repository,write:repository' \ + GENERATED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)" + ``` + +3. Verify field presence without printing values: + + ```bash + bao kv metadata get platform/workloads/forgejo/forgejo-admin + ``` + +--- + +## Consumers (downstream wiring — after lane verified) + +| Consumer | Repo | +| --- | --- | +| `tools/cmd/forgejo-package-prune` | `railiance-platform` | +| `weekly-forgejo-package-prune` activity | `activity-core` | +| `forgejo-operator-bootstrap`, `forgejo-npm-smoke`, `reuse-forgejo-webhook` | `railiance-apps` | + +Docs: `railiance-platform/docs/forgejo-package-prune.md`, +`railiance-apps/docs/forgejo-on-railiance01.md`. + +--- + +## See also + +- `railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml` +- `railiance-platform/openbao/policies/workload-kv-read-forgejo-admin.hcl` +- `wiki/playbooks/railiance-backup-offsite-lane.md` (OIDC workstation read pattern) +- `forgejo-mailer` lane — SMTP only; unchanged \ No newline at end of file diff --git a/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md b/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md new file mode 100644 index 0000000..cb6b640 --- /dev/null +++ b/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md @@ -0,0 +1,106 @@ +--- +id: WARDEN-WP-0025 +type: workplan +title: "Forgejo admin PAT OpenBao lane (CCR-2026-0006)" +domain: infotech +repo: ops-warden +status: active +owner: grok +topic_slug: custodian +planning_priority: high +planning_order: 25 +created: "2026-07-12" +updated: "2026-07-12" +--- + +# WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane + +**Trigger:** the-custodian CCR request (msg `54125f84`) — establish OpenBao custody +for the Forgejo site-admin PAT at `platform/workloads/forgejo/forgejo-admin`. +Drivers: `ACTIVITY-WP-0020` weekly package prune and railiance-apps/platform tools +still using `/tmp/forgejo-tegwick-api-token` or `FORGEJO_ADMIN_TOKEN`. + +**Boundary:** ops-warden holds no PAT; workstation OIDC fetch mirrors +`railiance-backup-offsite-lane` (CCR-2026-0004). Distinct from `forgejo-mailer` +(SMTP via ESO). Phase 1: no cluster ExternalSecret. + +**Depends on:** platform-operator approval of CCR-2026-0006; attended PAT mint. + +--- + +## Tasks + +### T1 — Draft CCR + policy metadata + +```task +id: WARDEN-WP-0025-T01 +status: done +priority: high +``` + +- [x] `CCR-2026-0006-forgejo-admin-api-token-lane.yaml` (`status: proposed`) +- [x] `openbao/policies/workload-kv-read-forgejo-admin.hcl` +- [x] `docs/workload-kv-access-lanes.md` section + +### T2 — ops-warden catalog + playbook + +```task +id: WARDEN-WP-0025-T02 +status: done +priority: high +``` + +- [x] Catalog entry `forgejo-admin-api-token` (`status: draft`) +- [x] `wiki/playbooks/forgejo-admin-api-token.md` + +### T3 — Platform-operator approval + metadata apply + +```task +id: WARDEN-WP-0025-T03 +status: todo +priority: high +``` + +- [ ] CCR approved by platform-operator +- [ ] `scripts/credential-change.py applier-dry-run CCR-2026-0006` +- [ ] Policy `workload-kv-read-forgejo-admin` + OIDC role `forgejo-admin-workload-kv-read` applied on `bao.coulomb.social` +- [ ] Non-secret `delegated_metadata_apply` evidence on CCR + +### T4 — Attended PAT provision + verification + +```task +id: WARDEN-WP-0025-T04 +status: todo +priority: high +``` + +- [ ] Mint PAT as Forgejo user `tegwick` (attended) +- [ ] `bao kv put platform/workloads/forgejo/forgejo-admin` (API_TOKEN + metadata) +- [ ] Positive fetch after OIDC login; negative default-policy denial +- [ ] `warden route find "forgejo admin pat"` resolves; promote catalog to `active` when verified + +### T5 — Notify downstream consumers + +```task +id: WARDEN-WP-0025-T05 +status: wait +priority: medium +``` + +- [ ] Ack the-custodian with CCR id + catalog id (no secret values) +- [ ] Signal railiance-platform / activity-core / railiance-apps to wire `load_token()` OpenBao paths + +--- + +## Acceptance + +- CCR-2026-0006 approved, policy + OIDC role live, PAT in OpenBao +- `warden route find "forgejo admin pat"` → `forgejo-admin-api-token` +- No PAT in Git, State Hub, workplans, logs, or chat +- Workstation file drop retired as steady-state path after downstream wiring + +## See also + +- `railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml` +- `activity-core/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md` +- Custodian message `54125f84-e9df-4fa0-9309-7370633a20d3` \ No newline at end of file