coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
147 commits 1 branch 0 tags 467 KiB
Commit graph

12 commits

Author SHA1 Message Date
tegwick
0055e8f3f7 Establish railiance backup credentials in OpenBao (CCR-2026-0004).
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details 
Add workload KV lane for Nextcloud WebDAV token, URL, and age recovery
escrow at platform/workloads/railiance/backup/offsite-lane. Apply read
policy and OIDC role railiance-backup-workload-kv-read; wire forgejo-backup
to load credentials from OpenBao when env is unset.
 2026-07-07 17:16:30 +02:00
tegwick
0941d6e8f9 Add OpenBao External Secrets lane for Forgejo mailer on railiance01
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details 
Introduce external-secrets-forgejo policy/role, ClusterSecretStore
openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.
 2026-07-07 14:30:02 +02:00
tegwick
38936d8fd6 Close delegated prod applier pilot 2026-07-01 23:34:13 +02:00
tegwick
a95236d2e5 Add credential-change delegated applier flow 2026-07-01 20:07:26 +02:00
tegwick
eb24e04b71 Correct whynot credential tenant path 2026-06-28 01:00:12 +02:00
tegwick
aee0dcefad Add credential lane readiness proposals 2026-06-27 23:30:29 +02:00
tegwick
85a4278a55 Add credential approval workflow plan 2026-06-27 22:48:24 +02:00
tegwick
752cfd6f00 feat: add credential broker token helper 2026-06-27 00:06:03 +02:00
tegwick
693dc71833 Add ESO OpenBao GitOps add-ons 2026-06-25 20:08:36 +02:00
tegwick
7838df6069 fix(openbao): complete SSH apply script for OpenBao 2.5.x issuers 
Generate default CA via ssh/config/ca, split composite KUBECTL for role writes,
read pubkey from config/ca, allow warden key_id in roles, prefer production kubeconfig.
 2026-06-18 01:18:56 +02:00
tegwick
c24956fb5a feat(openbao): add SSH engine automation for ops-warden signing 
Declarative roles, warden-sign policy, apply/verify scripts, and Makefile
targets openbao-configure-ssh and openbao-verify-ssh. Document operator flow
in docs/openbao.md for NET-WP-0020 T5 / WP-0008 T2.
 2026-06-18 01:06:43 +02:00
tegwick
a7ffeb8b46 Platform secret setup 2026-05-23 13:59:58 +02:00