From 390a30a5c1a97eef18a31c755b7b75fc91702bb0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 13 Oct 2026 13:59:43 +0200 Subject: [PATCH] security: persist Forgejo receive hook inheritance for new repositories Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2 --- Makefile | 8 +++++++- helm/forgejo-values.yaml | 17 +++++++++++++++++ manifests/forgejo-secret-scan-template.yaml | 20 ++++++++++++++++++++ 3 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 manifests/forgejo-secret-scan-template.yaml diff --git a/Makefile b/Makefile index 7b24eb8..c02679d 100644 --- a/Makefile +++ b/Makefile @@ -63,6 +63,7 @@ FORGEJO_CHART_VERSION ?= 12.5.0 FORGEJO_VALUES ?= helm/forgejo-values.yaml FORGEJO_REGISTRY_VALUES ?= helm/forgejo-registry-values.yaml FORGEJO_SECRETS ?= helm/forgejo-secrets.sops.yaml +FORGEJO_SECRET_SCAN_TEMPLATE ?= manifests/forgejo-secret-scan-template.yaml FORGEJO_INGRESS ?= manifests/forgejo-ingress.yaml FORGEJO_SSH_NODEPORT ?= manifests/forgejo-ssh-nodeport.yaml FORGEJO_BASE_URL ?= https://forgejo.coulomb.social @@ -469,7 +470,10 @@ forgejo-server-dry-run: check-railiance01-kubeconfig ## Helm server dry-run Forg -f <(KUBECONFIG="$(FORGEJO_KUBECONFIG)" tools/forgejo-helm-secrets.sh) \ --dry-run=server --timeout 5m -forgejo-deploy: check-railiance01-kubeconfig forgejo-mailer-es-deploy ## Deploy / upgrade Forgejo on railiance01 +forgejo-secret-scan-template-deploy: check-railiance01-kubeconfig ## Install the immutable, non-secret receive-hook template + KUBECONFIG="$(FORGEJO_KUBECONFIG)" kubectl apply --server-side -f $(FORGEJO_SECRET_SCAN_TEMPLATE) + +forgejo-deploy: check-railiance01-kubeconfig forgejo-mailer-es-deploy forgejo-secret-scan-template-deploy ## Deploy / upgrade Forgejo on railiance01 @test -n "$$(KUBECONFIG="$(FORGEJO_KUBECONFIG)" kubectl get secret forgejo-mailer -n $(FORGEJO_NAMESPACE) -o name 2>/dev/null)" || { \ echo "Missing secret forgejo-mailer in $(FORGEJO_NAMESPACE)." >&2; \ echo "Ensure ExternalSecret is Ready and OpenBao role external-secrets-forgejo is configured." >&2; \ @@ -643,3 +647,5 @@ help: ## Show this help /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST) .PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status apps-pg-restore-drill check-railiance01-kubeconfig check-inter-hub-image-tag check-inter-hub-image check-vergabe-image-tag check-vergabe-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret check-coulomb-social-image-tag coulomb-social-dry-run coulomb-social-deploy coulomb-social-ingress-deploy coulomb-social-status coulomb-social-logs coulomb-social-env-secret coulomb-social-env-secret-dry-run eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs inter-hub-render-baseline inter-hub-dry-run inter-hub-server-dry-run inter-hub-deploy inter-hub-status inter-hub-release-info inter-hub-smoke inter-hub-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs reuse-forgejo-webhook reuse-openbao-eso-token-apply reuse-openbao-store-deploy reuse-runtime-es-deploy reuse-runtime-es-status reuse-webhook-smoke policy-nexus-check-binding policy-nexus-check-image policy-nexus-render policy-nexus-server-dry-run policy-nexus-deploy policy-nexus-status policy-nexus-smoke policy-nexus-rollback help + +.PHONY: forgejo-secret-scan-template-deploy diff --git a/helm/forgejo-values.yaml b/helm/forgejo-values.yaml index 44861c9..f5e479a 100644 --- a/helm/forgejo-values.yaml +++ b/helm/forgejo-values.yaml @@ -30,6 +30,21 @@ redis-cluster: valkey-cluster: enabled: false +# File subPath keeps Git from copying ConfigMap projection symlinks. +extraVolumes: +- name: secret-scan-template + configMap: + name: forgejo-secret-template-b1d7cf8cd13f + defaultMode: 365 +extraContainerVolumeMounts: +- &id001 + name: secret-scan-template + mountPath: /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan + subPath: hook + readOnly: true +extraInitVolumeMounts: +- *id001 + gitea: admin: username: forgejo_admin @@ -37,6 +52,8 @@ gitea: passwordMode: initialOnlyRequireReset # Mailer password from OpenBao via ExternalSecret forgejo-mailer (not Helm/SOPS). additionalConfigFromEnvs: + - name: GITEA__GIT_0X2E_CONFIG__INIT_0X2E_TEMPLATEDIR + value: /opt/forge-secret-template - name: GITEA__mailer__PASSWD valueFrom: secretKeyRef: diff --git a/manifests/forgejo-secret-scan-template.yaml b/manifests/forgejo-secret-scan-template.yaml new file mode 100644 index 0000000..7142fec --- /dev/null +++ b/manifests/forgejo-secret-scan-template.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: forgejo-secret-template-b1d7cf8cd13f + namespace: forgejo + labels: + app.kubernetes.io/part-of: forgejo + custodian.coulomb.social/workplan: FORGE-WP-0006 +immutable: true +data: + hook: '#!/bin/sh + + set +vx + + set -eu + + exec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan + --scanner /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks + + '