coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Establish railiance backup credentials in OpenBao (CCR-2026-0004).
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Add workload KV lane for Nextcloud WebDAV token, URL, and age recovery
escrow at platform/workloads/railiance/backup/offsite-lane. Apply read
policy and OIDC role railiance-backup-workload-kv-read; wire forgejo-backup
to load credentials from OpenBao when env is unset.
This commit is contained in:
tegwick 2026-07-07 17:16:30 +02:00
parent f428940da8
commit 0055e8f3f7
8 changed files with 430 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
openbao/policies/workload-kv-read-railiance-backup-offsite-lane.hcl Normal file
View file

@ -0,0 +1,13 @@
# Least-privilege read policy for the Railiance offsite backup lane (Option A).
#
# Grants read access to Nextcloud WebDAV upload credentials and age recovery
# escrow used by railiance-backup / forgejo-backup on operator workstations.
# No write, list, or sibling-workload capabilities.
path "platform/data/workloads/railiance/backup/offsite-lane" {
capabilities = ["read"]
}
path "platform/metadata/workloads/railiance/backup/offsite-lane" {
capabilities = ["read"]
}