coulomb/railiance-apps
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add Forgejo break-glass seal/verify tooling and recovery runbook
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
RAPPS-WP-0016-T01: founder-run targets rotate the forgejo_admin password
into OpenBao (platform/workloads/forgejo/break-glass-admin) and record a
value-free sign-in. T01 stays in progress until the founder runs them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1031639@bnt-lap001
Assistant-Session: e5073fee-f4ae-4fc3-a75a-6c1fc83e0576
This commit is contained in:
tegwick 2026-10-17 11:32:09 +02:00
parent fbe012789e
commit fe5cabecd6
5 changed files with 166 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

40
docs/forgejo-on-railiance01.md
View file

@ -104,6 +104,46 @@ make forgejo-runner-registration-sops-bootstrap
make check-sops SOPS_SENTINEL=helm/forgejo-runner-registration.sops.yaml
```
## Break-glass administrator (RAPPS-WP-0016-T01)
The floor under every sign-in change: one local site admin that works even when
NetKingdom, KeyCape or the OAuth source is broken.
| Item | Value |
| --- | --- |
| Account | `forgejo_admin` (chart bootstrap admin, local password, site admin) |
| Custody | OpenBao coulombcore `platform/workloads/forgejo/break-glass-admin`, field `PASSWORD` |
| Delivered to cluster | No. Not synced by ESO; only a human retrieves it |
| Who | The founder. Agents never read or hold the value |
The SOPS admin password in `helm/forgejo-secrets.sops.yaml` is only the chart's
initial value (`passwordMode: initialOnlyRequireReset`); Helm upgrades do not
reset the account. It is not the break-glass credential.
Seal or rotate, then verify (founder, interactive):
```bash
make forgejo-breakglass-seal # new password -> OpenBao first, then Forgejo
make forgejo-breakglass-verify # one local sign-in; writes docs/evidence/<date>-forgejo-breakglass-signin.json
```
Recovery when normal sign-in is broken:
1. `bao kv get -field=PASSWORD platform/workloads/forgejo/break-glass-admin`
(operator token on `https://bao.coulomb.social`).
2. Sign in at `https://forgejo.coulomb.social/user/login` as `forgejo_admin`
with local credentials. Local password sign-in stays enabled for this account
even if RAPPS-WP-0016-T04 restricts it for everyone else.
3. Repair the authentication source or users from Site Administration.
4. If the password itself is lost: with cluster access, run
`make forgejo-breakglass-seal` again (it sets the password through the
Forgejo CLI in the pod, so it needs no working sign-in).
5. Afterwards rotate (`make forgejo-breakglass-seal`), verify, and record the use.
Where it is logged: OpenBao audit log (retrieval), Forgejo log and the account's
last-login time (sign-in), the evidence file in `docs/evidence/`, and a State Hub
progress event naming why break-glass was used.
## SMTP (IONOS) — password reset / notifications
Decision: `the-custodian/docs/forgejo-production-decisions.md` (IONOS, 2026-07-07).