coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add CCR-2026-0006 Forgejo admin PAT OpenBao lane

Browse source 
Establish proposed workload-kv-read custody for the Forgejo site-admin
PAT at platform/workloads/forgejo/forgejo-admin, sibling to forgejo-mailer.
OIDC workstation fetch mirrors the railiance-backup-offsite pattern.
This commit is contained in:
tegwick 2026-07-12 16:01:53 +02:00
parent 618641c984
commit 25fc47e5f2
3 changed files with 156 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
openbao/policies/workload-kv-read-forgejo-admin.hcl Normal file
View file

@ -0,0 +1,13 @@
# Least-privilege read policy for the Forgejo operator/admin API token (PAT).
#
# Grants read access to the site-admin PAT used by workstation and activity-core
# automation (package prune, org webhooks, operator bootstrap). Sibling to
# forgejo-mailer (SMTP); no cluster ESO delivery in phase 1.
path "platform/data/workloads/forgejo/forgejo-admin" {
capabilities = ["read"]
}
path "platform/metadata/workloads/forgejo/forgejo-admin" {
capabilities = ["read"]
}