unkinben
bd7bef9f99
Why: the vault-plugin-secrets-gitea engine needs a purpose-built Gitea site-admin credential to mint and delete per-user tokens. Provision that account and its Vault seed here so the credential is generated once and never exposed. Ben asked that the password be written to Vault exactly once and never updated afterwards. Change: - Add config/git.unkin.net/user/gitea-vault-admin.yaml: a local site-admin bot (admin: true, limited visibility, no org/repo creation). - Extend the user module with an optional vault_seed_path/vault_seed_mount: when set, write the account's generated password to Vault KV as admin_username and admin_password via vault_kv_secret_v2, with lifecycle ignore_changes on data_json so the write is create-only and never churns (random_password already never regenerates). This keeps the seed stable and prevents a re-apply from overwriting a password later rotated out-of-band by rotate-root. - Add the hashicorp/vault provider (module plus root generate block); it reads VAULT_ADDR and VAULT_TOKEN already exported by the Makefile k8s login. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
22 lines
1.2 KiB
YAML
22 lines
1.2 KiB
YAML
# Purpose-built Gitea site-admin bot for the vault-plugin-secrets-gitea engine.
|
|
# The engine seeds itself from this account's credentials (Basic Auth) to mint
|
|
# and delete per-user tokens for any user. Its randomly generated password is
|
|
# written ONCE to Vault KV (vault_seed_path below) and never updated after; the
|
|
# Vault gitea engine reads that seed only when first creating gitea/config and
|
|
# then rotates it (rotate-root) so only Vault holds the live password.
|
|
#
|
|
# A local (not external-auth) account with 2FA disabled is required so the
|
|
# engine can change the password via the admin API during rotate-root.
|
|
email: gitea-vault-admin@unkin.net
|
|
full_name: "Gitea Vault Admin"
|
|
description: "site-admin bot; credentials seeded to Vault for vault-plugin-secrets-gitea"
|
|
# Site admin so the engine may mint/delete tokens for any user. No org/repo
|
|
# creation; profile visible only to signed-in users.
|
|
visibility: limited
|
|
admin: true
|
|
allow_create_organization: false
|
|
max_repo_creation: 0
|
|
# Seed this account's generated password to Vault KV (mount "kv") at this path,
|
|
# where the Vault gitea secrets engine reads it at creation time. Written once.
|
|
vault_seed_path: "service/vault/au/syd1/secret_backend/gitea/config"
|