coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/wiki/playbooks/reuse-surface-hub-write-token.md
tegwick 661176e37a
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Retire CoulombCore references; correct the 16443 diagnosis 
CoulombCore is being retired, so the docs stop using it as the reference host:
state-hub-coulombcore examples become state-hub-railiance01, and the reuse-surface
playbook no longer attributes bao.coulomb.social to it — that resolves to
92.205.62.239, which is railiance01. The openrouter lane keeps its factual note
about ESO on the CoulombCore cluster, with a retirement flag for its owner.

Also corrects this session's own error. The WP-0031 evidence blamed the
Unauthorized on a local-port collision between k3s-api-coulombcore and
k3s-api-haskelseed. That was wrong: the haskelseed tunnel is a reverse forward,
where local_port is a destination rather than a listener, so they never competed.
16443 was simply CoulombCore's k3s — a different cluster whose client CA does not
know that cert. The wrong reason had already gone to flex-auth, so it is
corrected in the file rather than quietly dropped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 19:31:41 +02:00

3.4 KiB
Raw Blame History

reuse-surface Hub Write Token — OpenBao Custody

Date: 2026-07-07 (promoted active 2026-07-07)
Workplan: RAILIANCE-WP-0011-T03 · CCR-2026-0005
Catalog: reuse-surface-hub-write-token (active — path live, ESO delivering)

Bearer token for authenticated writes to the production federation hub at https://reuse.coulomb.social (POST /v1/repos, reuse-surface hub register). ops-warden does not vend this token — custody belongs to railiance-platform (OpenBao) and the reuse-surface workload via External Secrets.

Owner-confirmed lane (no placeholders)

Field Value
OpenBao server https://bao.coulomb.social (railiance01, 92.205.62.239)
KV path platform/workloads/reuse/reuse-surface/runtime-secrets
Hub write field REUSE_SURFACE_TOKEN
Webhook HMAC field REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
Read policy workload-kv-read-reuse-surface-runtime
ESO delivery ExternalSecret reuse/reuse-surface-runtime → reuse-surface-env (Railiance01)
Deploy runbook railiance-apps/docs/reuse-surface-on-railiance01.md
Hub API spec reuse-surface/specs/FederationHubAPI.md

Promotion gate (met 2026-07-07): path seeded, ExternalSecret reuse/reuse-surface-runtime SecretSynced, positive hub + webhook verification and negative default-policy denial recorded in CCR-2026-0005.

Break-glass (cluster read)

If OpenBao is unreachable, operators with Railiance01 kubeconfig may read the materialized Secret (ESO cache):

kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse \
  -o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d

Never paste values into chat, State Hub, workplans, or Git.

Worker checklist

  1. Confirm OpenBao reachability (you act as yourself; ops-warden adds no credential):

    bao kv metadata get platform/workloads/reuse/reuse-surface/runtime-secrets

  2. Export hub write token for a shell session (streams to your terminal):

    export REUSE_SURFACE_URL=https://reuse.coulomb.social
export REUSE_SURFACE_TOKEN=$(
  bao kv get -field=REUSE_SURFACE_TOKEN \
    platform/workloads/reuse/reuse-surface/runtime-secrets
)

  3. Or proxy via warden access (same bao kv get, audited metadata only):

    warden route show reuse-surface-hub-write-token --json
warden access reuse-surface-hub-write-token --no-policy --fetch

  4. Webhook HMAC (same path, second field — must match Forgejo org webhook):

    bao kv get -field=REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET \
  platform/workloads/reuse/reuse-surface/runtime-secrets

    After rotation: railiance-apps make reuse-forgejo-webhook.

  5. Register a repo after publish-check passes:

    reuse-surface hub status
reuse-surface hub register --repo <slug> \
  --url <forgejo-raw-capabilities-yaml-url> \
  --domain <domain>

  6. Verify federated index picked up the new source:

    curl -fsS "$REUSE_SURFACE_URL/v1/federated" | jq '.sources | map(.repo) | index("<slug>")'

Rotation: railiance-platform/docs/reuse-surface-runtime-secrets-rotation-runbook.md (OpenBao patch → ESO force-sync → hub rollout → make reuse-forgejo-webhook when the webhook HMAC changes → make reuse-webhook-smoke). Lifecycle: railiance-platform/docs/credential-lane-lifecycle-runbook.md (CCR-2026-0005).