tegwick
ddeac8bf9c
Mark T03 done, T04 in progress; document forgejo-admin-pat-provision.sh in the worker playbook.
113 lines
No EOL
3.4 KiB
Markdown
113 lines
No EOL
3.4 KiB
Markdown
---
|
|
id: WARDEN-WP-0025
|
|
type: workplan
|
|
title: "Forgejo admin PAT OpenBao lane (CCR-2026-0006)"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: active
|
|
owner: grok
|
|
topic_slug: custodian
|
|
planning_priority: high
|
|
planning_order: 25
|
|
created: "2026-07-12"
|
|
updated: "2026-07-12"
|
|
state_hub_workstream_id: "5bd18d0b-88bf-4791-a940-ff62b836e6d7"
|
|
---
|
|
|
|
# WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane
|
|
|
|
**Trigger:** the-custodian CCR request (msg `54125f84`) — establish OpenBao custody
|
|
for the Forgejo site-admin PAT at `platform/workloads/forgejo/forgejo-admin`.
|
|
Drivers: `ACTIVITY-WP-0020` weekly package prune and railiance-apps/platform tools
|
|
still using `/tmp/forgejo-tegwick-api-token` or `FORGEJO_ADMIN_TOKEN`.
|
|
|
|
**Boundary:** ops-warden holds no PAT; workstation OIDC fetch mirrors
|
|
`railiance-backup-offsite-lane` (CCR-2026-0004). Distinct from `forgejo-mailer`
|
|
(SMTP via ESO). Phase 1: no cluster ExternalSecret.
|
|
|
|
**Depends on:** platform-operator approval of CCR-2026-0006; attended PAT mint.
|
|
|
|
---
|
|
|
|
## Tasks
|
|
|
|
### T1 — Draft CCR + policy metadata
|
|
|
|
```task
|
|
id: WARDEN-WP-0025-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "6faf5138-fbf9-4380-a2d7-3765f02c64ec"
|
|
```
|
|
|
|
- [x] `CCR-2026-0006-forgejo-admin-api-token-lane.yaml` (`status: proposed`)
|
|
- [x] `openbao/policies/workload-kv-read-forgejo-admin.hcl`
|
|
- [x] `docs/workload-kv-access-lanes.md` section
|
|
|
|
### T2 — ops-warden catalog + playbook
|
|
|
|
```task
|
|
id: WARDEN-WP-0025-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "fdb42d37-2978-4b84-9547-b0046773b3a3"
|
|
```
|
|
|
|
- [x] Catalog entry `forgejo-admin-api-token` (`status: draft`)
|
|
- [x] `wiki/playbooks/forgejo-admin-api-token.md`
|
|
|
|
### T3 — Platform-operator approval + metadata apply
|
|
|
|
```task
|
|
id: WARDEN-WP-0025-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "65dcbf2f-28e1-42c8-8419-a766e3087502"
|
|
```
|
|
|
|
- [x] CCR approved by platform-operator (bernd.worsch, 2026-07-12)
|
|
- [x] `scripts/credential-change.py applier-dry-run CCR-2026-0006`
|
|
- [x] Policy `workload-kv-read-forgejo-admin` + OIDC role `forgejo-admin-workload-kv-read` applied on `bao.coulomb.social`
|
|
- [x] Non-secret `delegated_metadata_apply` evidence on CCR
|
|
|
|
### T4 — Attended PAT provision + verification
|
|
|
|
```task
|
|
id: WARDEN-WP-0025-T04
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "bc249196-8692-434a-91b1-4232951246dd"
|
|
```
|
|
|
|
- [ ] Mint PAT as Forgejo user `tegwick` (attended)
|
|
- [ ] `scripts/forgejo-admin-pat-provision.sh` → `platform/workloads/forgejo/forgejo-admin`
|
|
- [ ] Positive fetch after OIDC login
|
|
- [x] Negative default-policy denial recorded on CCR
|
|
- [ ] Promote catalog to `active` after positive verify
|
|
|
|
### T5 — Notify downstream consumers
|
|
|
|
```task
|
|
id: WARDEN-WP-0025-T05
|
|
status: wait
|
|
priority: medium
|
|
state_hub_task_id: "24a6e98f-759c-43ce-a1dc-230b08b9d85c"
|
|
```
|
|
|
|
- [ ] Ack the-custodian with CCR id + catalog id (no secret values)
|
|
- [ ] Signal railiance-platform / activity-core / railiance-apps to wire `load_token()` OpenBao paths
|
|
|
|
---
|
|
|
|
## Acceptance
|
|
|
|
- CCR-2026-0006 approved, policy + OIDC role live, PAT in OpenBao
|
|
- `warden route find "forgejo admin pat"` → `forgejo-admin-api-token`
|
|
- No PAT in Git, State Hub, workplans, logs, or chat
|
|
- Workstation file drop retired as steady-state path after downstream wiring
|
|
|
|
## See also
|
|
|
|
- `railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml`
|
|
- `activity-core/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md`
|
|
- Custodian message `54125f84-e9df-4fa0-9309-7370633a20d3` |