unkin/terraform-git
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

user: add gitea-vault-admin site-admin bot with one-time Vault KV seeding #46

Merged
benvin merged 1 commits from benvin/gitea-vault-admin into main 2026-07-27 21:47:31 +10:00
Conversation 2 Commits 1 Files Changed 8
+77
unkinben commented 2026-07-27 19:30:15 +10:00
Owner
Copy Link
Copy Source

Why

The vault-plugin-secrets-gitea engine (deployed via terraform-vault #101) needs a purpose-built Gitea site-admin credential to mint and delete per-user tokens. Previously that account and its Vault KV seed were flagged as a manual gap. This closes the gap in Terraform: the account is created here and its generated password is seeded to Vault once, so no credential is ever created or copied by hand.

Per Ben's request, the password is written to Vault exactly once and never updated afterwards.

Change

  • Add config/git.unkin.net/user/gitea-vault-admin.yaml — a local site-admin bot (admin: true, limited visibility, no org/repo creation).
  • Extend the user module with an optional vault_seed_path (+ vault_seed_mount, default kv): when set, the account's generated password is written to Vault KV as admin_username + admin_password via vault_kv_secret_v2.
    • random_password has no keepers, so it never regenerates; the seed value is stable.
    • lifecycle { ignore_changes = [data_json] } makes the KV write create-only: written the first time and never re-written, so a later vault write -f gitea/config/rotate-root (which diverges the live Gitea password from this seed) is never clobbered by a re-apply.
  • Add the hashicorp/vault provider (module + root generate block); it reads VAULT_ADDR/VAULT_TOKEN already exported by the Makefile k8s auth login (role woodpecker_terraform_git).

Dependencies / ordering

  • Requires terraform-vault #102 (KV write grant for woodpecker_terraform_git) to merge + apply first, or this apply 403s writing the seed.
  • This PR must merge + apply (creating the bot user and the KV seed) before terraform-vault #101 applies (the engine reads the seed at gitea/config creation time).

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

## Why The `vault-plugin-secrets-gitea` engine (deployed via terraform-vault #101) needs a purpose-built Gitea site-admin credential to mint and delete per-user tokens. Previously that account and its Vault KV seed were flagged as a manual gap. This closes the gap in Terraform: the account is created here and its generated password is seeded to Vault once, so no credential is ever created or copied by hand. Per Ben's request, the password is written to Vault exactly once and never updated afterwards. ## Change - Add `config/git.unkin.net/user/gitea-vault-admin.yaml` — a local site-admin bot (`admin: true`, limited visibility, no org/repo creation). - Extend the `user` module with an optional `vault_seed_path` (+ `vault_seed_mount`, default `kv`): when set, the account's generated password is written to Vault KV as `admin_username` + `admin_password` via `vault_kv_secret_v2`. - `random_password` has no keepers, so it never regenerates; the seed value is stable. - `lifecycle { ignore_changes = [data_json] }` makes the KV write create-only: written the first time and never re-written, so a later `vault write -f gitea/config/rotate-root` (which diverges the live Gitea password from this seed) is never clobbered by a re-apply. - Add the `hashicorp/vault` provider (module + root generate block); it reads `VAULT_ADDR`/`VAULT_TOKEN` already exported by the Makefile k8s auth login (role `woodpecker_terraform_git`). ## Dependencies / ordering - Requires terraform-vault #102 (KV write grant for `woodpecker_terraform_git`) to merge + apply first, or this apply 403s writing the seed. - This PR must merge + apply (creating the bot user and the KV seed) before terraform-vault #101 applies (the engine reads the seed at `gitea/config` creation time). https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben added 1 commit 2026-07-27 19:30:15 +10:00
user: add gitea-vault-admin site-admin bot and one-time Vault KV seeding
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
bd7bef9f99 
Why: the vault-plugin-secrets-gitea engine needs a purpose-built Gitea
site-admin credential to mint and delete per-user tokens. Provision that
account and its Vault seed here so the credential is generated once and never
exposed. Ben asked that the password be written to Vault exactly once and
never updated afterwards.

Change:
- Add config/git.unkin.net/user/gitea-vault-admin.yaml: a local site-admin bot
  (admin: true, limited visibility, no org/repo creation).
- Extend the user module with an optional vault_seed_path/vault_seed_mount: when
  set, write the account's generated password to Vault KV as admin_username and
  admin_password via vault_kv_secret_v2, with lifecycle ignore_changes on
  data_json so the write is create-only and never churns (random_password
  already never regenerates). This keeps the seed stable and prevents a re-apply
  from overwriting a password later rotated out-of-band by rotate-root.
- Add the hashicorp/vault provider (module plus root generate block); it reads
  VAULT_ADDR and VAULT_TOKEN already exported by the Makefile k8s login.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin reviewed 2026-07-27 20:47:17 +10:00
modules/gitea_instance/modules/user/terraform.tf
@@ -11,1 +11,4 @@
}
vault = {
source = "hashicorp/vault"
version = ">= 4.3"
benvin commented 2026-07-27 20:47:17 +10:00
Owner
Copy Link
Copy Source

This is an old release?

This is an old release?
unkinben commented 2026-07-27 20:57:25 +10:00
Author
Owner
Copy Link
Copy Source

Re: the go-gitea/gitea provider pin on modules/gitea_instance/modules/user/terraform.tf ("This is an old release?") —

It's not out of date: 0.7.0 is the latest published release of go-gitea/gitea (published 2025-06-18) on both the OpenTofu and Terraform registries. This PR inherited the pin from the rest of the repo — all 7 terraform.tf files pin it to 0.7.0 consistently, so there's nothing to bump.

There is a v0.8.0 git tag on go-gitea/terraform-provider-gitea, but it was never published to a registry (no GitHub release; /v1/providers/go-gitea/gitea/0.8.0/download/... 404s on both registries), so it isn't installable via the go-gitea/gitea source address. If we want it, someone has to get it published upstream or mirror it into artifactapi first — happy to do that as a separate change if you'd like, but it's out of scope for this PR.

New providers I added here: hashicorp/vault >= 4.3 (resolves to the current 5.10.1) matching the repo's floor-pin style for hashicorp/random >= 3.5 (3.9.0). No existing-provider version changed, so the plan is only the new gitea-vault-admin user + its one-time KV seed — no churn to existing users/repos.

Re: the `go-gitea/gitea` provider pin on `modules/gitea_instance/modules/user/terraform.tf` ("This is an old release?") — It's not out of date: **0.7.0 is the latest published release** of `go-gitea/gitea` (published 2025-06-18) on both the OpenTofu and Terraform registries. This PR inherited the pin from the rest of the repo — all 7 `terraform.tf` files pin it to 0.7.0 consistently, so there's nothing to bump. There is a `v0.8.0` **git tag** on go-gitea/terraform-provider-gitea, but it was never published to a registry (no GitHub release; `/v1/providers/go-gitea/gitea/0.8.0/download/...` 404s on both registries), so it isn't installable via the `go-gitea/gitea` source address. If we want it, someone has to get it published upstream or mirror it into artifactapi first — happy to do that as a separate change if you'd like, but it's out of scope for this PR. New providers I added here: `hashicorp/vault` `>= 4.3` (resolves to the current 5.10.1) matching the repo's floor-pin style for `hashicorp/random` `>= 3.5` (3.9.0). No existing-provider version changed, so the plan is only the new `gitea-vault-admin` user + its one-time KV seed — no churn to existing users/repos.
benvin merged commit 99b13d81bc into main 2026-07-27 21:47:31 +10:00
benvin deleted branch benvin/gitea-vault-admin 2026-07-27 21:47:32 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
benvin
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) repospawner (Repo Spawner) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-git#46
Delete Branch "benvin/gitea-vault-admin"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?