Add OpenBao External Secrets lane for Forgejo mailer on railiance01

Introduce external-secrets-forgejo policy/role, ClusterSecretStore
openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.

Makefile

@@ -193,6 +193,17 @@ openbao-configure-external-secrets-issue-core: ## Configure OpenBao policy/role
 openbao-configure-external-secrets-activity-core: ## Configure OpenBao policy/role for activity-core ESO lane
 	KUBECTL='$(KUBECTL)' OPENBAO_NAMESPACE=$(OPENBAO_NAMESPACE) 	  OPENBAO_RELEASE=$(OPENBAO_RELEASE) ESO_NAMESPACE=$(EXTERNAL_SECRETS_NAMESPACE) 	  OPENBAO_ESO_ROLE=external-secrets-activity-core 	  OPENBAO_ESO_POLICY=workload-kv-read-llm-connect-provider-secrets 	  POLICY_FILE='$(CURDIR)/openbao/policies/workload-kv-read-llm-connect-provider-secrets.hcl' 	  scripts/openbao-apply-external-secrets-issue-core.sh
 
+openbao-configure-external-secrets-forgejo: ## Configure OpenBao policy/role for Forgejo mailer ESO lane
+	KUBECTL='$(KUBECTL)' OPENBAO_NAMESPACE=$(OPENBAO_NAMESPACE) \
+	  OPENBAO_RELEASE=$(OPENBAO_RELEASE) ESO_NAMESPACE=$(EXTERNAL_SECRETS_NAMESPACE) \
+	  OPENBAO_ESO_ROLE=external-secrets-forgejo \
+	  OPENBAO_ESO_POLICY=external-secrets-forgejo \
+	  POLICY_FILE='$(CURDIR)/openbao/policies/external-secrets-forgejo.hcl' \
+	  OPENBAO_ESO_NEXT_PATH=platform/workloads/forgejo/forgejo-mailer \
+	  OPENBAO_ESO_NEXT_FIELDS=MAILER_PASSWD \
+	  OPENBAO_ESO_NEXT_TARGET=ExternalSecret/forgejo/forgejo-mailer \
+	  scripts/openbao-apply-external-secrets-issue-core.sh
+
 openbao-workload-kv-lanes-dry-run: ## Dry-run OpenBao workload KV read-lane policy apply
 	scripts/openbao-apply-workload-kv-lanes.sh --dry-run $(OPENBAO_WORKLOAD_KV_ARGS)
 
@@ -355,4 +366,4 @@ help: ## Show this help
 	  /^[a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-22s\033[0m %s\n", $$1, $$2 } \
 	  /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
 
-.PHONY: db-deploy db-status db-shell db-logs forgejo-db-deploy forgejo-db-status forgejo-db-shell apps-pg-deploy apps-pg-status apps-pg-shell apps-pg-logs net-kingdom-pg-inter-hub-networkpolicy-deploy pg-deploy pg-status pg-pgpool-check valkey-deploy valkey-status openbao-repo openbao-dry-run openbao-overlay-apply openbao-verify-login-overlay openbao-deploy openbao-status openbao-verify openbao-verify-post-unseal openbao-configure-initial openbao-configure-ssh openbao-verify-ssh openbao-verify-authenticated openbao-configure-external-secrets-issue-core openbao-configure-external-secrets-activity-core openbao-validate-restore-evidence openbao-validate-emergency-evidence credential-grants-validate credential-change-applier-dry-run credential-change-applier-apply-plan credential-change-applier-apply credential-change-runbook credential-change-record-evidence credential-change-lifecycle-plan credential-change-lifecycle-event credential-change-import-inventory openbao-credential-change-appliers-dry-run openbao-configure-credential-change-appliers openbao-token-grants-dry-run openbao-configure-token-grants openbao-verify-token-grants-dry-run openbao-verify-token-grants openbao-verify-token-grants-smoke credential-helper-dry-run credential-tests credential-exec-ops-warden-smoke argocd-bootstrap-dry-run argocd-bootstrap-deploy argocd-repo-apply argocd-status backup help
+.PHONY: db-deploy db-status db-shell db-logs forgejo-db-deploy forgejo-db-status forgejo-db-shell apps-pg-deploy apps-pg-status apps-pg-shell apps-pg-logs net-kingdom-pg-inter-hub-networkpolicy-deploy pg-deploy pg-status pg-pgpool-check valkey-deploy valkey-status openbao-repo openbao-dry-run openbao-overlay-apply openbao-verify-login-overlay openbao-deploy openbao-status openbao-verify openbao-verify-post-unseal openbao-configure-initial openbao-configure-ssh openbao-verify-ssh openbao-verify-authenticated openbao-configure-external-secrets-issue-core openbao-configure-external-secrets-activity-core openbao-configure-external-secrets-forgejo openbao-validate-restore-evidence openbao-validate-emergency-evidence credential-grants-validate credential-change-applier-dry-run credential-change-applier-apply-plan credential-change-applier-apply credential-change-runbook credential-change-record-evidence credential-change-lifecycle-plan credential-change-lifecycle-event credential-change-import-inventory openbao-credential-change-appliers-dry-run openbao-configure-credential-change-appliers openbao-token-grants-dry-run openbao-configure-token-grants openbao-verify-token-grants-dry-run openbao-verify-token-grants openbao-verify-token-grants-smoke credential-helper-dry-run credential-tests credential-exec-ops-warden-smoke argocd-bootstrap-dry-run argocd-bootstrap-deploy argocd-repo-apply argocd-status backup help

argocd/platform-addons/openbao-secretstore/kustomization.yaml

@@ -4,3 +4,4 @@ kind: Kustomization
 resources:
   - openbao.clustersecretstore.yaml
   - openbao-activity-core.clustersecretstore.yaml
+  - openbao-forgejo.clustersecretstore.yaml

argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml

@@ -0,0 +1,23 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-forgejo
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+spec:
+  provider:
+    vault:
+      server: http://openbao.openbao.svc.cluster.local:8200
+      path: platform
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets-forgejo
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets
+  conditions:
+    - namespaces:
+        - forgejo

openbao/policies/external-secrets-forgejo.hcl

@@ -0,0 +1,13 @@
+# Least-privilege policy for External Secrets Operator Forgejo mailer lane.
+#
+# The matching Kubernetes auth role binds only the ESO service account in the
+# external-secrets namespace. ClusterSecretStore usage is separately limited to
+# the forgejo namespace.
+
+path "platform/data/workloads/forgejo/*" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/forgejo/*" {
+  capabilities = ["read", "list"]
+}

openbao/policies/workload-kv-read-forgejo-mailer.hcl

@@ -0,0 +1,7 @@
+path "platform/data/workloads/forgejo/forgejo-mailer" {
+  capabilities = ["read"]
+}
+
+path "platform/metadata/workloads/forgejo/forgejo-mailer" {
+  capabilities = ["read"]
+}