---
id: WARDEN-WP-0025
type: workplan
title: "Forgejo admin PAT OpenBao lane (CCR-2026-0006)"
domain: infotech
repo: ops-warden
status: finished
owner: grok
topic_slug: custodian
planning_priority: high
planning_order: 25
created: "2026-07-12"
updated: "2026-07-13"
state_hub_workstream_id: "70c11222-d8e7-5936-99f7-7d626a4a5deb"
---

# WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane

**Trigger:** the-custodian CCR request (msg `54125f84`) — establish OpenBao custody
for the Forgejo site-admin PAT at `platform/workloads/forgejo/forgejo-admin`.
Drivers: `ACTIVITY-WP-0020` weekly package prune and railiance-apps/platform tools
still using `/tmp/forgejo-tegwick-api-token` or `FORGEJO_ADMIN_TOKEN`.

**Boundary:** ops-warden holds no PAT; workstation OIDC fetch mirrors
`railiance-backup-offsite-lane` (CCR-2026-0004). Distinct from `forgejo-mailer`
(SMTP via ESO). Phase 1: no cluster ExternalSecret.

**Depends on:** platform-operator approval of CCR-2026-0006; attended PAT mint.

---

## Tasks

### T1 — Draft CCR + policy metadata

```task
id: WARDEN-WP-0025-T01
status: done
priority: high
state_hub_task_id: "2c288bf0-b39c-5f5b-ad25-eed3da826dc3"
```

- [x] `CCR-2026-0006-forgejo-admin-api-token-lane.yaml` (`status: proposed`)
- [x] `openbao/policies/workload-kv-read-forgejo-admin.hcl`
- [x] `docs/workload-kv-access-lanes.md` section

### T2 — ops-warden catalog + playbook

```task
id: WARDEN-WP-0025-T02
status: done
priority: high
state_hub_task_id: "01b81595-f9e5-5746-b0dd-2075189cb00e"
```

- [x] Catalog entry `forgejo-admin-api-token` (`status: draft`)
- [x] `wiki/playbooks/forgejo-admin-api-token.md`

### T3 — Platform-operator approval + metadata apply

```task
id: WARDEN-WP-0025-T03
status: done
priority: high
state_hub_task_id: "279b74d7-3240-5ca0-897d-b1ddffd23c4e"
```

- [x] CCR approved by platform-operator (bernd.worsch, 2026-07-12)
- [x] `scripts/credential-change.py applier-dry-run CCR-2026-0006`
- [x] Policy `workload-kv-read-forgejo-admin` + OIDC role `forgejo-admin-workload-kv-read` applied on `bao.coulomb.social`
- [x] Non-secret `delegated_metadata_apply` evidence on CCR

### T4 — Attended PAT provision + verification

```task
id: WARDEN-WP-0025-T04
status: done
priority: high
state_hub_task_id: "4e21232c-62a1-5115-acce-edfbcfa84e48"
```

- [x] Mint PAT as Forgejo user `tegwick` (attended, 2026-07-12)
- [x] Stored at `platform/workloads/forgejo/forgejo-admin`, field `API_TOKEN`
      (initial provision used field `Token`; re-stored as `API_TOKEN` 2026-07-13 to
      match CCR/catalog/playbook `fetch_command`)
- [x] Positive fetch verified 2026-07-13 — `bao kv get -field=API_TOKEN …` returns
      non-empty; PAT valid against `forgejo.coulomb.social` (`/api/v1/user` →
      `login=tegwick`, `is_admin=true`)
- [x] Negative default-policy denial recorded on CCR
- [x] Promoted catalog `forgejo-admin-api-token` to `active` (`resolvable: true`)

### T5 — Notify downstream consumers

```task
id: WARDEN-WP-0025-T05
status: done
priority: medium
state_hub_task_id: "f8c7c70b-b9b6-5980-a25b-7f11033b81a2"
```

- [x] Ack the-custodian with CCR id + catalog id (no secret values) — msg 949e8ed1, 2026-07-13
- [x] Signal railiance-platform / activity-core / railiance-apps to wire `load_token()`
      OpenBao paths — msgs 5be8e500 / 9ed1af98 / 2e47b6e5, 2026-07-13

---

## Acceptance

- CCR-2026-0006 approved, policy + OIDC role live, PAT in OpenBao
- `warden route find "forgejo admin pat"` → `forgejo-admin-api-token`
- No PAT in Git, State Hub, workplans, logs, or chat
- Workstation file drop retired as steady-state path after downstream wiring

## See also

- `railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml`
- `activity-core/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md`
- Custodian message `54125f84-e9df-4fa0-9309-7370633a20d3`