Wire Forgejo SMTP password from OpenBao via External Secrets

Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.

helm/forgejo-secrets.sops.yaml

@@ -1,11 +1,9 @@
 gitea:
     admin:
-        password: ENC[AES256_GCM,data:D4vjZzWdKb8FgCXcRp+Ndjya1yFqB995,iv:WzOzUMTu4TBcpEgYFkz186CnmSpmmQ+Jqnz8I4ZpVVw=,tag:hHbXEhBGfNhr63mNF/HTBA==,type:str]
+        password: ENC[AES256_GCM,data:/0h7UHVFAKQbOczZs880ZhroIMYeuaWM,iv:cJu65mLICZHlog65qL/7OWZbMAa+2v+zXt1e8i/veqc=,tag:FJecXS8ImotmwO/avJYQ4A==,type:str]
     config:
         database:
-            PASSWD: ENC[AES256_GCM,data:oHp70axstRWh4YPYeKNpt8a8eejgFjyw6azdhZG1WqA=,iv:B9acXzEmJ2tGzkIkG2X/RsrdSGwzV/dgOI3Hn8/J9is=,tag:WHs/yEIZ7upffCXaOUfPuQ==,type:str]
-        mailer:
-            PASSWD: ENC[AES256_GCM,data:W3+t8Hgn4/yPAvVWYa/Gkn4=,iv:NrL0TD3lTQWfVIzxbjJi9FrZrMmI6s4Bpo8zvMKVHLI=,tag:pBvK4wrhOOWUDI2wtg7MIQ==,type:str]
+            PASSWD: ENC[AES256_GCM,data:80VKXVe/XGiO2ROOjyweHVveYpnn/KnVfnF93IB1QY0=,iv:wAaNx2B1F3yvNliB2ntecPIPLh+lTwWTsLyM70YktCs=,tag:0hzr9dwlz8AyN5uv3AbylA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -15,14 +13,14 @@ sops:
         - recipient: age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsbjJqRG9uOUZiU0RjSnVm
-            aE9ZaitSdjdjb0RNU2pzNGlsTHV5K2I1MGlBCms2RFRPelA1ODBoVTZidFZnOC9u
-            ZllVazZDRmZjQzg4L0E3QXpJWDFIUGcKLS0tIFViM0czZDR6dUFTRmZXRUQ0RW9w
-            aEF0RDMzb0o1YzduZHIxUGNBdVRnOGMKjDu/B39gqkT2JJ/7NGbFqmyUPtGAf3ST
-            sUNhOgGXQRs6576QSiUEzO8Prio/lnFPM96boMgXv4+Gt2dcPmXyoA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwaWZ0cldQNDQyNUxJeUdX
+            ZG1jbS9HVUlzUFNuM3pMdzlLS1BHSGZmb21rCmpGRG9wOVV4bGl3VmtGRk14a1o5
+            RzhDUWpPaGozZjh5YWsxdXI4NmdoRzAKLS0tIE5qTG53b2pMRGhlZzNUa3l0ejBy
+            eE5nRDQ4WWswdmtvNmx1OSsxZVl0eG8K0Njs3CVPwUKVM4rnriJq7EXIUg0HbT5F
+            qRiSwY8fmFa2nW38mbII1Bna6w6ahGMNdIeGL/u4tlt/Bt+iIAYItw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-07-07T00:41:12Z"
-    mac: ENC[AES256_GCM,data:8TM3EOv3yhYfh6QTTcD2AJK1y77JJKygwoJUMULN3q3A+b/RefpXs6+h66wn13P9EvQu9FTZg0kwijLUOCktuBPfaAiz00+BK9PFtt5UsDA9g/qUVA5EUxpmq0vRzDv1njhomwmI/f9pMbKiXRvXpkXxhpMeRx6XN0D4itCEMvI=,iv:RlicLXVU7kQgfc6bM2wAvyAB8zAMX3G8ZPeToJ73g14=,tag:Det/rkDaw8LqJNqZlkGKkw==,type:str]
+    lastmodified: "2026-07-07T12:27:30Z"
+    mac: ENC[AES256_GCM,data:tGhGH9PjoTCSJlIi6Rh/n3jiUN/Heu7L3yvLWP1cKOZMg2N1G+B/mL0trAJbyzljbi1M/LgKEf7eUwLM1gAciLQG8pRBZqb3L+IwErf7/+ul1mhyZSwwL5DuzP+hxnwRh06TLBxbV1jYSdY5QmL8QmeNxmvgVA+4AC6CIlX7IzY=,iv:OVN6s2uobQ4jup2hoAB1+EIXe+yz49J1hJZRjTCbezU=,tag:Y9xKxrhq2DkHt2EgPq8ZJQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4

helm/forgejo-secrets.sops.yaml.template

@@ -1,5 +1,7 @@
 # Encrypt as helm/forgejo-secrets.sops.yaml before production deploy.
-# Contains database PASSWD, admin password, and IONOS SMTP mailbox password.
+# Contains database PASSWD and admin password consumed by the gitea chart.
+# IONOS SMTP password lives in OpenBao platform/workloads/forgejo/forgejo-mailer
+# and is synced by manifests/forgejo-mailer-externalsecret.yaml.
 #
 # gitea:
 #   admin:
@@ -7,13 +9,9 @@
 #   config:
 #     database:
 #       PASSWD: <same as forgejo-db-credentials>
-#     mailer:
-#       PASSWD: <IONOS mailbox password for forgejo@coulomb.social>
 gitea:
   admin:
     password: REPLACE_WITH_ADMIN_PASSWORD
   config:
     database:
-      PASSWD: REPLACE_WITH_DB_PASSWORD
-    mailer:
-      PASSWD: REPLACE_WITH_IONOS_MAILBOX_PASSWORD
+      PASSWD: REPLACE_WITH_DB_PASSWORD

helm/forgejo-values.yaml

@@ -35,6 +35,13 @@ gitea:
     username: forgejo_admin
     email: admin@coulomb.social
     passwordMode: initialOnlyRequireReset
+  # Mailer password from OpenBao via ExternalSecret forgejo-mailer (not Helm/SOPS).
+  additionalConfigFromEnvs:
+    - name: GITEA__mailer__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-mailer
+          key: MAILER_PASSWD
   config:
     database:
       DB_TYPE: postgres