coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add CCR-2026-0006 Forgejo admin PAT OpenBao lane

Browse source 
Establish proposed workload-kv-read custody for the Forgejo site-admin
PAT at platform/workloads/forgejo/forgejo-admin, sibling to forgejo-mailer.
OIDC workstation fetch mirrors the railiance-backup-offsite pattern.
This commit is contained in:
tegwick 2026-07-12 16:01:53 +02:00
parent 618641c984
commit 25fc47e5f2
3 changed files with 156 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

40
docs/workload-kv-access-lanes.md
View file

@ -320,3 +320,43 @@ Or let `lib/railiance-backup-common.sh` load from OpenBao after login when env i
Recovery escrow (`AGE_PRIVATE_KEY`) is stored in the same path for disaster
recovery; prefer the password-manager copy on restore drills per
`railiance-cluster/docs/backup-restore.md`. Fetch only in attended sessions.
## Forgejo admin API token lane (`CCR-2026-0006`)
Workstation and activity-core automation (`forgejo-package-prune`, org webhooks,
operator bootstrap) need a Forgejo site-admin PAT. Phase 1 replaces the legacy
workstation file `/tmp/forgejo-tegwick-api-token` and `FORGEJO_ADMIN_TOKEN` env
drops with OpenBao custody. Sibling to `forgejo-mailer` (SMTP); no cluster ESO
in phase 1.
| Item | Value |
| --- | --- |
| CCR | `CCR-2026-0006-forgejo-admin-api-token-lane` |
| KV mount | `platform` |
| OpenBao CLI path | `platform/workloads/forgejo/forgejo-admin` |
| Fields | `API_TOKEN` (secret); optional metadata `API_USER`, `API_BASE_URL`, `TOKEN_SCOPES`, `GENERATED_AT` |
| Read policy | `workload-kv-read-forgejo-admin` |
| Policy file | `openbao/policies/workload-kv-read-forgejo-admin.hcl` |
| OIDC auth mount | `netkingdom` |
| OIDC role | `forgejo-admin-workload-kv-read` |
| Bound claim | `groups=net-kingdom-admins` |
| ops-warden catalog id | `forgejo-admin-api-token` (draft until front door verified) |
Caller login:
```bash
bao login -method=oidc -path=netkingdom role=forgejo-admin-workload-kv-read
```
Fetch PAT for a Forgejo API run (do not log the value):
```bash
export FORGEJO_ADMIN_TOKEN=$(
bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin
)
```
PAT mint: attended session as Forgejo user `tegwick` (site admin). Minimum scopes:
`read:package`, `write:package`, `read:repository`, `write:repository`, plus admin
scopes required by `forgejo-operator-bootstrap`. Downstream repos update `load_token()`
to read OpenBao when env is unset after lane verification.