jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

chore(secrets): fold vault.example.yml into the manifest and remove it #47

Merged
jfraeys merged 2 commits from jfraeys/chore/manifest-absorbs-example into main 2026-10-10 12:17:12 -04:00
Conversation 0 Commits 2 Files changed 13 +239 -313
jfraeys commented 2026-10-10 11:31:25 -04:00
Owner
Copy link

Per request: update the secret manifest and remove the example vault.

  • secrets/secrets-manifest.yml: header no longer refers to the example; all entries previously owned by .env are vault-owned; CI replicas recorded (LINODE_TOKEN, CLOUDFLARE_API_TOKEN, OBJECT_STORAGE_*); known privileges/expiry added (FORGEJO_ADMIN_TOKEN = read:admin + write:admin on a site-admin service account, so it cannot comment on PRs: HTTP 403 in terraform-plan run 270; CI_EPHEMERAL_FORGEJO_REPO_TOKEN = read:repository; TAILSCALE_AUTHKEY ~24h); new config: section documents 18 non-secret vault keys the example described. manage secret list-expiring still reads it; original rotation fields unchanged.
  • secrets/vault.example.yml removed; references fixed (README, docs, .gitignore, a roles/backups comment).
  • .forgejo/ci-secrets.yml: CI_FORGEJO_ADMIN_TOKEN is no longer mapped to the vault admin token. It is set by hand with comment scope; a --force sync would have overwritten it with a token that gets 403.
  • Also deleted locally (untracked): secrets/vault.yml.ansible-vault, byte-identical to secrets/backup/vault.yml.20261009_193913_pre-sops.

Kept on purpose: secrets/.vault_pass (ansible.cfg still points at it; Ansible refuses to start without it, so it goes with the Ansible Vault retirement) and secrets/backup/ (rollback copies, including the SOPS backups rotations create).

🤖 Generated with Claude Code

Per request: update the secret manifest and remove the example vault. - `secrets/secrets-manifest.yml`: header no longer refers to the example; all entries previously owned by `.env` are vault-owned; CI replicas recorded (LINODE_TOKEN, CLOUDFLARE_API_TOKEN, OBJECT_STORAGE_*); known privileges/expiry added (FORGEJO_ADMIN_TOKEN = read:admin + write:admin on a site-admin service account, so it cannot comment on PRs: HTTP 403 in terraform-plan run 270; CI_EPHEMERAL_FORGEJO_REPO_TOKEN = read:repository; TAILSCALE_AUTHKEY ~24h); new `config:` section documents 18 non-secret vault keys the example described. `manage secret list-expiring` still reads it; original rotation fields unchanged. - `secrets/vault.example.yml` removed; references fixed (README, docs, .gitignore, a roles/backups comment). - `.forgejo/ci-secrets.yml`: CI_FORGEJO_ADMIN_TOKEN is no longer mapped to the vault admin token. It is set by hand with comment scope; a `--force` sync would have overwritten it with a token that gets 403. - Also deleted locally (untracked): `secrets/vault.yml.ansible-vault`, byte-identical to `secrets/backup/vault.yml.20261009_193913_pre-sops`. Kept on purpose: `secrets/.vault_pass` (ansible.cfg still points at it; Ansible refuses to start without it, so it goes with the Ansible Vault retirement) and `secrets/backup/` (rollback copies, including the SOPS backups rotations create). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
chore(secrets): fold vault.example.yml into the manifest and remove it
All checks were successful
Lint / lint (pull_request) Successful in 1m15s
Details
6a230ac541
 
The manifest becomes the single catalog of vault keys: ownership fields are
current (all .env-owned entries now vault-owned, CI replicas recorded, known
token scopes and expiry noted: notably FORGEJO_ADMIN_TOKEN is read:admin +
write:admin only and cannot comment on PRs), and a config: section documents
the non-secret vault keys the example used to describe. vault.example.yml is
removed and every reference updated. .forgejo/ci-secrets.yml no longer maps
CI_FORGEJO_ADMIN_TOKEN to that admin-only vault token, so a --force sync cannot
overwrite the hand-set PR-comment token with one that cannot comment.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
feat(ci): give CI its own scoped Forgejo token (CI_FORGEJO_COMMENT_TOKEN)
All checks were successful
Lint / lint (pull_request) Successful in 1m56s
Details
6cbc3d4e72
 
The vault's FORGEJO_ADMIN_TOKEN is a read:admin/write:admin service-account
token and gets 403 on issues and PRs, so CI could never comment or open the
promotion PR with it. CI now uses CI_FORGEJO_COMMENT_TOKEN, a repo-scoped
token with its own vault key, mapped in .forgejo/ci-secrets.yml and recorded
in the manifest; the five workflow references are renamed. A read-only test
shows it reads pulls/issue comments (200) and has no user scope (403).
The old hand-set CI_FORGEJO_ADMIN_TOKEN repo secret is now unreferenced.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!47
No description provided.