0055e8f3f7
Establish railiance backup credentials in OpenBao (CCR-2026-0004).
...
CI Smoke / host-smoke (push) Waiting to run
CI Smoke / container-smoke (push) Waiting to run
Add workload KV lane for Nextcloud WebDAV token, URL, and age recovery
escrow at platform/workloads/railiance/backup/offsite-lane. Apply read
policy and OIDC role railiance-backup-workload-kv-read; wire forgejo-backup
to load credentials from OpenBao when env is unset.
2026-07-07 17:16:30 +02:00
0941d6e8f9
Add OpenBao External Secrets lane for Forgejo mailer on railiance01
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 6s
Introduce external-secrets-forgejo policy/role, ClusterSecretStore
openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.
2026-07-07 14:30:02 +02:00
38936d8fd6
Close delegated prod applier pilot
2026-07-01 23:34:13 +02:00
a95236d2e5
Add credential-change delegated applier flow
2026-07-01 20:07:26 +02:00
eb24e04b71
Correct whynot credential tenant path
2026-06-28 01:00:12 +02:00
aee0dcefad
Add credential lane readiness proposals
2026-06-27 23:30:29 +02:00
85a4278a55
Add credential approval workflow plan
2026-06-27 22:48:24 +02:00
752cfd6f00
feat: add credential broker token helper
2026-06-27 00:06:03 +02:00
693dc71833
Add ESO OpenBao GitOps add-ons
2026-06-25 20:08:36 +02:00
c24956fb5a
feat(openbao): add SSH engine automation for ops-warden signing
...
Declarative roles, warden-sign policy, apply/verify scripts, and Makefile
targets openbao-configure-ssh and openbao-verify-ssh. Document operator flow
in docs/openbao.md for NET-WP-0020 T5 / WP-0008 T2.
2026-06-18 01:06:43 +02:00
a7ffeb8b46
Platform secret setup
2026-05-23 13:59:58 +02:00
