From d61173d66e0893030b0d93accf2f6029905a3b5b Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 7 Jul 2026 15:21:40 +0200
Subject: [PATCH] Fix Forgejo mailer ESO field mapping and token bootstrap env

Map OpenBao key PASSWD to Secret MAILER_PASSWD so ExternalSecret syncs
against the live coulombcore path. Allow non-interactive bootstrap via
OPENBAO_TOKEN_FILE for make forgejo-openbao-eso-token-apply.
---
 manifests/forgejo-mailer-externalsecret.yaml |  4 ++--
 tools/forgejo-openbao-eso-token-apply.sh     | 17 +++++++++++++++--
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/manifests/forgejo-mailer-externalsecret.yaml b/manifests/forgejo-mailer-externalsecret.yaml
index 0ebbe5d..4585bc1 100644
--- a/manifests/forgejo-mailer-externalsecret.yaml
+++ b/manifests/forgejo-mailer-externalsecret.yaml
@@ -1,7 +1,7 @@
 # Forgejo IONOS SMTP password from OpenBao (RAIL-HO-WP-0005-T06).
 #
 # OpenBao path (platform KV v2): workloads/forgejo/forgejo-mailer
-# Field: MAILER_PASSWD (optional SMTP_USER for non-Helm consumers)
+# Field: PASSWD (OpenBao key); synced to Secret key MAILER_PASSWD for Helm
 #
 # Prereqs on railiance01:
 #   - External Secrets Operator (make eso-deploy)
@@ -27,4 +27,4 @@ spec:
     - secretKey: MAILER_PASSWD
       remoteRef:
         key: workloads/forgejo/forgejo-mailer
-        property: MAILER_PASSWD
\ No newline at end of file
+        property: PASSWD
\ No newline at end of file
diff --git a/tools/forgejo-openbao-eso-token-apply.sh b/tools/forgejo-openbao-eso-token-apply.sh
index d6b2f16..40d8be6 100755
--- a/tools/forgejo-openbao-eso-token-apply.sh
+++ b/tools/forgejo-openbao-eso-token-apply.sh
@@ -22,8 +22,21 @@ fi
 
 echo "OpenBao addr: $BAO_ADDR"
 echo "Policy: $POLICY_NAME"
-read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
-echo >&2
+
+if [[ -n "${BAO_TOKEN:-}" ]]; then
+  :
+elif [[ -n "${OPENBAO_TOKEN_FILE:-}" && -f "${OPENBAO_TOKEN_FILE}" ]]; then
+  BAO_TOKEN="$(head -n 1 "${OPENBAO_TOKEN_FILE}")"
+else
+  read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
+  echo >&2
+fi
+
+if [[ -z "${BAO_TOKEN:-}" ]]; then
+  echo "ERROR: empty OpenBao token" >&2
+  exit 1
+fi
+
 export BAO_ADDR BAO_TOKEN
 
 health="$(curl -fsS "$BAO_ADDR/v1/sys/health")"