tegwick
0055e8f3f7
Add workload KV lane for Nextcloud WebDAV token, URL, and age recovery escrow at platform/workloads/railiance/backup/offsite-lane. Apply read policy and OIDC role railiance-backup-workload-kv-read; wire forgejo-backup to load credentials from OpenBao when env is unset.
13 lines
No EOL
475 B
HCL
13 lines
No EOL
475 B
HCL
# Least-privilege read policy for the Railiance offsite backup lane (Option A).
|
|
#
|
|
# Grants read access to Nextcloud WebDAV upload credentials and age recovery
|
|
# escrow used by railiance-backup / forgejo-backup on operator workstations.
|
|
# No write, list, or sibling-workload capabilities.
|
|
|
|
path "platform/data/workloads/railiance/backup/offsite-lane" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/railiance/backup/offsite-lane" {
|
|
capabilities = ["read"]
|
|
} |