coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(openbao): agent-harness forgejo deploy-key read policy
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Add workload-kv-read-agent-harness-forgejo and document the harness
deploy-key + mail AppRole lanes provisioned on railiance01.
This commit is contained in:
tegwick 2026-07-17 23:57:54 +02:00
parent 183647c33a
commit d4c95f78ff
2 changed files with 51 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

40
docs/workload-kv-access-lanes.md
View file

@ -396,3 +396,43 @@ warden access binky-company-email-imap --all --out /tmp/p # preferred
```
Onboarding playbook: `ops-warden/wiki/playbooks/tenant-secret-onboarding.md`.
## agent-harness Forgejo deploy key
| Item | Value |
| --- | --- |
| ops-warden catalog id | `agent-harness-forgejo-deploy` |
| OpenBao CLI path | `platform/workloads/agent-harness/forgejo-deploy-key` |
| Fields | `SSH_PRIVATE_KEY`, `SSH_PUBLIC_KEY` |
| Read policy | `workload-kv-read-agent-harness-forgejo` |
| Policy file | `openbao/policies/workload-kv-read-agent-harness-forgejo.hcl` |
| Worker host | railiance01 `~/.local/agent-harness/ssh/forgejo-deploy` |
| Deploy key repos | `coulomb/executor-sandbox` (write); `binky-control` at cutover |
| Front-door readiness | active (provisioned 2026-07-17) |
| Risk | high |
```bash
# public key only is safe to print; never print SSH_PRIVATE_KEY
bao kv get -field=SSH_PUBLIC_KEY platform/workloads/agent-harness/forgejo-deploy-key
```
## agent-harness Binky mail AppRole
| Item | Value |
| --- | --- |
| ops-warden catalog id | `agent-harness-binky-mail-approle` |
| AppRole name | `agent-harness-binky-mail` |
| Token policies | `workload-kv-read-binky-company-email-imap` |
| token_ttl / max | 15m / 30m |
| token_num_uses | 8 |
| Host delivery | railiance01 `~/.local/agent-harness/approle-binky-mail/{role_id,secret_id}` |
| Env | `EXECUTOR_APPROLE_DIR` via `~/.local/agent-harness/env` |
| Front-door readiness | active (provisioned 2026-07-17) |
| Risk | high |
Does **not** replace the human OIDC role
`binky-company-email-imap-workload-kv-read`. Same secret path; separate
unattended principal.
Playbook: `ops-warden/wiki/playbooks/agent-harness-secrets.md`.

11
openbao/policies/workload-kv-read-agent-harness-forgejo.hcl Normal file
View file

@ -0,0 +1,11 @@
# Least-privilege read policy for agent-harness Forgejo deploy key.
# Private key is held on the worker host; OpenBao holds a recovery/copy.
# Exact path only — no list on parent, no sibling workload paths.
path "platform/data/workloads/agent-harness/forgejo-deploy-key" {
capabilities = ["read"]
}
path "platform/metadata/workloads/agent-harness/forgejo-deploy-key" {
capabilities = ["read"]
}