coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/workplans/WARDEN-WP-0025-forgejo-admin-api-token-lane.md
tegwick fd231fac0d
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 18s
Details
Add forgejo-admin-api-token catalog lane (CCR-2026-0006) 
Draft routing entry and worker playbook for Forgejo site-admin PAT custody
in OpenBao. Workplan WARDEN-WP-0025 tracks approval, apply, and verification.
2026-07-12 16:01:53 +02:00

3 KiB
Raw Blame History

id type title domain repo status owner topic_slug planning_priority planning_order created updated
WARDEN-WP-0025 workplan Forgejo admin PAT OpenBao lane (CCR-2026-0006) infotech ops-warden active grok custodian high 25 2026-07-12 2026-07-12

WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane

Trigger: the-custodian CCR request (msg 54125f84) — establish OpenBao custody for the Forgejo site-admin PAT at platform/workloads/forgejo/forgejo-admin. Drivers: ACTIVITY-WP-0020 weekly package prune and railiance-apps/platform tools still using /tmp/forgejo-tegwick-api-token or FORGEJO_ADMIN_TOKEN.

Boundary: ops-warden holds no PAT; workstation OIDC fetch mirrors railiance-backup-offsite-lane (CCR-2026-0004). Distinct from forgejo-mailer (SMTP via ESO). Phase 1: no cluster ExternalSecret.

Depends on: platform-operator approval of CCR-2026-0006; attended PAT mint.

Tasks

T1 — Draft CCR + policy metadata

id: WARDEN-WP-0025-T01
status: done
priority: high
  • CCR-2026-0006-forgejo-admin-api-token-lane.yaml (status: proposed)
  • openbao/policies/workload-kv-read-forgejo-admin.hcl
  • docs/workload-kv-access-lanes.md section

T2 — ops-warden catalog + playbook

id: WARDEN-WP-0025-T02
status: done
priority: high
  • Catalog entry forgejo-admin-api-token (status: draft)
  • wiki/playbooks/forgejo-admin-api-token.md

T3 — Platform-operator approval + metadata apply

id: WARDEN-WP-0025-T03
status: todo
priority: high
  • CCR approved by platform-operator
  • scripts/credential-change.py applier-dry-run CCR-2026-0006
  • Policy workload-kv-read-forgejo-admin + OIDC role forgejo-admin-workload-kv-read applied on bao.coulomb.social
  • Non-secret delegated_metadata_apply evidence on CCR

T4 — Attended PAT provision + verification

id: WARDEN-WP-0025-T04
status: todo
priority: high
  • Mint PAT as Forgejo user tegwick (attended)
  • bao kv put platform/workloads/forgejo/forgejo-admin (API_TOKEN + metadata)
  • Positive fetch after OIDC login; negative default-policy denial
  • warden route find "forgejo admin pat" resolves; promote catalog to active when verified

T5 — Notify downstream consumers

id: WARDEN-WP-0025-T05
status: wait
priority: medium
  • Ack the-custodian with CCR id + catalog id (no secret values)
  • Signal railiance-platform / activity-core / railiance-apps to wire load_token() OpenBao paths

Acceptance

  • CCR-2026-0006 approved, policy + OIDC role live, PAT in OpenBao
  • warden route find "forgejo admin pat" → forgejo-admin-api-token
  • No PAT in Git, State Hub, workplans, logs, or chat
  • Workstation file drop retired as steady-state path after downstream wiring

See also

  • railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml
  • activity-core/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
  • Custodian message 54125f84-e9df-4fa0-9309-7370633a20d3