From 600a7747b0f95a2b179ea7f59800a53ee3dece9d Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 16 Aug 2026 14:49:33 +1000
Subject: [PATCH] vault: ghp engine config-write + consumer policies (apply
 before #121) (#122)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why: step 2 of the ordered ghp plugin add (install via puppet -> **this policy** -> resources). The terraform apply identities (tf_vault / woodpecker_terraform_vault) need create/update on ghp/config + ghp/roles/* BEFORE the engine resources are applied — an approle token capability set is fixed at login, so the grant must be effective in a prior apply or writing ghp/config is permission-denied.

How: split out of #121 — policies/ghp/admin.yaml (deployer: ghp/config + ghp/roles/*) and policies/ghp/creds/agent.yaml (agents approle: read ghp/creds/agent).

Order: puppet-prod#520 (install plugin) -> **this** -> #121 (resources).
Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/122
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 policies/ghp/admin.yaml       | 37 +++++++++++++++++++++++++++++++++++
 policies/ghp/creds/agent.yaml | 13 ++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 policies/ghp/admin.yaml
 create mode 100644 policies/ghp/creds/agent.yaml

diff --git a/policies/ghp/admin.yaml b/policies/ghp/admin.yaml
new file mode 100644
index 0000000..58ea65f
--- /dev/null
+++ b/policies/ghp/admin.yaml
@@ -0,0 +1,37 @@
+# Allow the vault deployer to manage the ghp token secrets engine: its
+# connection config (seeded service token) and its token-minting roles.
+#
+# Scoped to ghp/* only, and deliberately excludes ghp/creds/* - minting tokens
+# is for consumers, not the deployer. ghp has NO rotate endpoint, so unlike the
+# gitea/netbox engines there is no config/rotate grant here. The plugin-catalog
+# grant needed to import the plugin is the shared, sudo-protected wildcard in
+# policies/sys/plugins/catalog/admin.yaml (already covers this plugin), and
+# mounting the engine uses the deployer's existing sys/mounts/* access, so no
+# new catalog/mount grant is added here (mirrors the gitea/netbox engines).
+---
+rules:
+  # Engine connection config (base_url, TLS, seeded service token).
+  - path: "ghp/config"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  # Token-minting roles.
+  - path: "ghp/roles/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+      - list
+  - path: "ghp/roles"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
diff --git a/policies/ghp/creds/agent.yaml b/policies/ghp/creds/agent.yaml
new file mode 100644
index 0000000..fb99925
--- /dev/null
+++ b/policies/ghp/creds/agent.yaml
@@ -0,0 +1,13 @@
+# Lets the agents AppRole mint ephemeral ghp agent tokens, so AI coding agents
+# authenticate to ghp as their own short-lived, least-privilege identity.
+# Reading ghp/creds/agent returns a lease-bound token scoped by the role
+# (token_type agent, contents:read). Mirrors the gitea/creds/unkin-agent binding.
+---
+rules:
+  - path: "ghp/creds/agent"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - agents