From d289775e385c945d770180d477efd17834b754fa Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Mon, 27 Jul 2026 19:10:21 +1000
Subject: [PATCH] policies: grant the vault deployer access to the gitea
 secrets engine (#100)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why

The forthcoming `gitea_secret_backend` + role configuration (separate PR, `benvin/gitea-secret-engine`) is applied by terraform-vault under the deployment identity (`tf_vault` approle / `woodpecker_terraform_vault` k8s role). That identity has no access to the `gitea/` mount yet, so writing the engine's config and roles would 403. This mirrors `policies/rancher/admin.yaml`.

## Change

- Add `policies/gitea/admin.yaml` granting the deployer:
  - create/read/update/delete on `gitea/config`
  - create/update on `gitea/config/rotate-root` (write-only rotation trigger)
  - full manage + list on `gitea/roles/*` (and list on `gitea/roles`)
- Deliberately excludes `gitea/creds/*` — minting tokens is for consumers, not the deployer.
- No new catalog or mount grant: plugin registration is already covered by the shared, sudo-protected wildcard in `policies/sys/plugins/catalog/admin.yaml`, and mounting uses the deployer's existing `sys/mounts/*` access — same as the rancher engine.

## Order

Merge and apply this **before** the `benvin/gitea-secret-engine` PR, so the deployer can write the engine config/roles on that apply.

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/100
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
---
 policies/gitea/admin.yaml | 42 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 policies/gitea/admin.yaml

diff --git a/policies/gitea/admin.yaml b/policies/gitea/admin.yaml
new file mode 100644
index 0000000..a68e743
--- /dev/null
+++ b/policies/gitea/admin.yaml
@@ -0,0 +1,42 @@
+# Allow the vault deployer to manage the gitea token secrets engine: its
+# connection config (seeded admin credentials), in-place root rotation, and
+# token-minting roles.
+#
+# Scoped to gitea/* only, and deliberately excludes gitea/creds/* — minting
+# tokens is for consumers, not the deployer. The plugin-catalog grant needed to
+# import the plugin is the shared, sudo-protected wildcard in
+# policies/sys/plugins/catalog/admin.yaml (already covers this plugin), and
+# mounting the engine uses the deployer's existing sys/mounts/* access, so no
+# new catalog/mount grant is added here (mirrors the rancher engine).
+---
+rules:
+  # Engine connection config (Gitea URL, TLS, seeded admin username/password).
+  - path: "gitea/config"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  # In-place rotation of the seeded admin password (write-only trigger).
+  - path: "gitea/config/rotate-root"
+    capabilities:
+      - create
+      - update
+  # Token-minting roles.
+  - path: "gitea/roles/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+      - list
+  - path: "gitea/roles"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault