unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Let the agents AppRole mint unkin-agent Gitea tokens #114

Merged
benvin merged 1 commits from benvin/agents-gitea-creds into master 2026-08-08 23:41:54 +10:00
Conversation 0 Commits 1 Files Changed 2
+34
unkinben commented 2026-08-08 22:39:13 +10:00
Owner
Copy Link
Copy Source

Why: AI coding agents authenticate to Gitea as Ben using Ben's token. With the unkin-agent identity now in place (terraform-git PR #59), the agents AppRole should issue that account's tokens directly so agent commits and PRs are attributable and carry only least-privilege scopes.

How:

  • add a gitea secrets-engine role minting ephemeral tokens for unkin-agent scoped to write:repository, write:issue, read:user — push branches and open PRs, never merge or administer
  • add a policy granting read on gitea/creds/unkin-agent, bound to the agents AppRole, mirroring the agent-* Kubernetes creds bindings

Depends on terraform-git PR #59: the unkin-agent Gitea account must exist before minted tokens work. The vault-plugin-secrets-gitea engine is already live (plugin v0.1.0 registered, gitea mount configured), so no engine/plugin change is needed here.

Why: AI coding agents authenticate to Gitea as Ben using Ben's token. With the unkin-agent identity now in place (terraform-git PR #59), the agents AppRole should issue that account's tokens directly so agent commits and PRs are attributable and carry only least-privilege scopes. How: - add a gitea secrets-engine role minting ephemeral tokens for unkin-agent scoped to write:repository, write:issue, read:user — push branches and open PRs, never merge or administer - add a policy granting read on gitea/creds/unkin-agent, bound to the agents AppRole, mirroring the agent-* Kubernetes creds bindings Depends on terraform-git PR #59: the unkin-agent Gitea account must exist before minted tokens work. The vault-plugin-secrets-gitea engine is already live (plugin v0.1.0 registered, gitea mount configured), so no engine/plugin change is needed here.
unkinben force-pushed benvin/agents-gitea-creds from a9502306f2 to 2f83b0f072 2026-08-08 22:43:07 +10:00 Compare
unkinben added 1 commit 2026-08-08 22:49:37 +10:00
Let the agents AppRole mint unkin-agent Gitea tokens
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
9cabc178f3 
Why: AI coding agents authenticate to Gitea as Ben using Ben's token. With
the unkin-agent identity now in place, the agents AppRole should issue that
account's tokens directly so agent commits and PRs are attributable and
carry only least-privilege scopes.

How:
- add a gitea secrets-engine role that mints ephemeral tokens for unkin-agent
  scoped to write:repository, write:issue, read:user -- push branches and open
  PRs, never merge or administer
- add a policy granting read on gitea/creds/unkin-agent and bind it to the
  agents AppRole, mirroring the agent-* Kubernetes creds bindings
unkinben force-pushed benvin/agents-gitea-creds from 2f83b0f072 to 9cabc178f3 2026-08-08 22:49:37 +10:00 Compare
benvin merged commit c20e7e4664 into master 2026-08-08 23:41:54 +10:00
benvin deleted branch benvin/agents-gitea-creds 2026-08-08 23:41:54 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#114
Delete Branch "benvin/agents-gitea-creds"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?