From 17a1eb4f2db33a3fe8ecec3a0b13e35d993b9751 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 15 Aug 2026 18:03:30 +1000
Subject: [PATCH] ghp: deploy the service-token fork image + wire
 GHP_AUTH_SERVICE_TOKENS

Switch ghp from ghcr.io/goodtune/ghp:0.20.0 to the in-house fork image
artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4 (built now
that the CA-baked buildx plugin lets the push to the internal-CA registry
succeed). The fork is behavior-identical to upstream except it accepts static
admin service tokens (GHP_AUTH_SERVICE_TOKENS), used by the forthcoming Vault ghp
secrets engine to authenticate as admin and mint scoped tokens.

The env is sourced from the ghp-app Secret key service_token with optional: true,
so ghp keeps running until Ben seeds service_token into
kv/kubernetes/namespace/ghp/default/app; the existing ghp-app reloader annotation
then rolls the Deployment to activate it.
---
 apps/base/ghp/deployment.yaml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml
index e4619b7..10dc862 100644
--- a/apps/base/ghp/deployment.yaml
+++ b/apps/base/ghp/deployment.yaml
@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ghp
-          image: ghcr.io/goodtune/ghp:0.20.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4
           imagePullPolicy: IfNotPresent
           # Drop the image's default --migrate so replicas never race migrations;
           # schema is applied by the wave-1 migrate hook Job instead.
@@ -88,6 +88,17 @@ spec:
                 secretKeyRef:
                   name: ghp-app
                   key: encryption_key
+            # Static admin service token for machine callers (the Vault ghp
+            # secrets engine authenticates with it to mint scoped tokens).
+            # optional: ghp runs fine without it until Ben seeds `service_token`
+            # into kv/kubernetes/namespace/ghp/default/app; the ghp-app reloader
+            # annotation then rolls this Deployment to pick it up.
+            - name: GHP_AUTH_SERVICE_TOKENS
+              valueFrom:
+                secretKeyRef:
+                  name: ghp-app
+                  key: service_token
+                  optional: true
           volumeMounts:
             - name: github-app
               mountPath: /etc/ghp/github-app