tegwick 171efa83fe

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Has been cancelled

Details

Promote forgejo-admin-api-token lane to active (WARDEN-WP-0025 T04)

PAT attended-minted and stored at platform/workloads/forgejo/forgejo-admin
under field API_TOKEN (re-stored from initial Token field to match
CCR/catalog/playbook fetch_command). Positive fetch verified: PAT valid
against forgejo.coulomb.social (/api/v1/user -> login=tegwick, is_admin=true).

- catalog: draft -> active, resolvable: true, verification evidence, reviewed 2026-07-13
- playbook: header active/resolvable, drop post-promotion caveat
- workplan: T04 done

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-13 01:47:52 +02:00

3.6 KiB

Raw Blame History

Forgejo Admin API Token (PAT)

Date: 2026-07-12 (verified 2026-07-13)
Catalog: forgejo-admin-api-token (status active, resolvable: true)
Owner: railiance-platform (CCR-2026-0006)

Forgejo site-admin personal access token for operator and automation tooling. Sibling to forgejo-mailer (SMTP via ESO); phase 1 is workstation + activity-core worker fetch only — no cluster ExternalSecret delivery.

OpenBao pointers

Field	Value
Mount	`platform`
Path	`platform/workloads/forgejo/forgejo-admin`
Secret field	`API_TOKEN` (PAT value)
Metadata fields	`API_USER`, `API_BASE_URL`, `TOKEN_SCOPES`, `GENERATED_AT` (optional, non-secret)
Policy	`workload-kv-read-forgejo-admin`
OIDC role	`forgejo-admin-workload-kv-read` (`groups=net-kingdom-admins`)

PAT scopes (minimum for current consumers): read:package, write:package, read:repository, write:repository, plus admin scopes as needed for forgejo-operator-bootstrap (mirror the current admin PAT).

Forgejo account: tegwick (site admin, coulomb Owners).

Worker checklist

Login (caller identity — ops-warden adds no credential):

bao login -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read

Export for a Forgejo API run (value streams to your shell — never paste into chat):

export FORGEJO_ADMIN_TOKEN=$(
  bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin
)

Or proxy via warden access (catalog lane is active):

warden access forgejo-admin-api-token --no-policy --fetch --field API_TOKEN

Run consumers:

# Package prune (railiance-platform)
make forgejo-package-prune-dry-run
make forgejo-package-prune

# Operator bootstrap / npm smoke / reuse webhook (railiance-apps)
make forgejo-operator-bootstrap
make forgejo-npm-smoke
make reuse-forgejo-webhook

Retire workstation file drop once downstream load_token() paths read OpenBao when env is unset:
- /tmp/forgejo-tegwick-api-token — legacy; do not use as steady state
- FORGEJO_ADMIN_TOKEN env — acceptable for one-off sessions after fetch

Operator provisioning (attended)

After CCR approval and policy apply:

Forgejo UI: tegwick → Settings → Applications → Generate New Token

Store in OpenBao (do not echo the value):

# PAT in a mode-0600 single-line file — never on argv
install -m 600 /dev/null /tmp/forgejo-admin-pat.input
# paste token into the file, then:
~/railiance-platform/scripts/forgejo-admin-pat-provision.sh /tmp/forgejo-admin-pat.input
shred -u /tmp/forgejo-admin-pat.input

Verify field presence without printing values:

bao kv metadata get platform/workloads/forgejo/forgejo-admin

Consumers (downstream wiring — after lane verified)

Consumer	Repo
`tools/cmd/forgejo-package-prune`	`railiance-platform`
`weekly-forgejo-package-prune` activity	`activity-core`
`forgejo-operator-bootstrap`, `forgejo-npm-smoke`, `reuse-forgejo-webhook`	`railiance-apps`

Docs: railiance-platform/docs/forgejo-package-prune.md, railiance-apps/docs/forgejo-on-railiance01.md.

3.6 KiB Raw Blame History