coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Wire Forgejo SMTP password from OpenBao via External Secrets
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.
This commit is contained in:
tegwick 2026-07-07 14:30:02 +02:00
parent 24c8882b69
commit d5bb4f66f2
7 changed files with 141 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/forgejo-on-railiance01.md
View file

@ -104,25 +104,28 @@ gitea:
USER: forgejo@coulomb.social
```
Mailbox password goes in `helm/forgejo-secrets.sops.yaml` (encrypt from template):
Mailbox password is stored in **OpenBao** and delivered by External Secrets:
```yaml
gitea:
config:
mailer:
PASSWD: <IONOS mailbox password>
```
| Item | Value |
| --- | --- |
| OpenBao path | `platform/workloads/forgejo/forgejo-mailer` |
| Field | `MAILER_PASSWD` |
| ExternalSecret | `manifests/forgejo-mailer-externalsecret.yaml` |
| Helm consumption | `gitea.additionalConfigFromEnvs` → `GITEA__mailer__PASSWD` |
Deploy path:
Bootstrap (railiance01):
```bash
cd ~/railiance-platform
KUBECONFIG=~/.kube/config-hosteurope make openbao-configure-external-secrets-forgejo
cd ~/railiance-apps
make check-sops
KUBECONFIG=~/.kube/config-hosteurope make forgejo-mailer-es-deploy
KUBECONFIG=~/.kube/config-hosteurope make forgejo-mailer-es-status # expect SecretSynced
KUBECONFIG=~/.kube/config-hosteurope make forgejo-deploy
# T06: Admin → user → Send reset password; confirm email delivery
```
Do not enable `mailer.ENABLED` until the SOPS secret is in place.
Do not put the SMTP password in `helm/forgejo-secrets.sops.yaml`.
## Coexistence with Gitea