unkinben
c20e7e4664
ci/woodpecker/push/apply Pipeline was successful
Why: AI coding agents authenticate to Gitea as Ben using Ben's token. With the unkin-agent identity now in place (terraform-git PR #59), the agents AppRole should issue that account's tokens directly so agent commits and PRs are attributable and carry only least-privilege scopes. How: - add a gitea secrets-engine role minting ephemeral tokens for unkin-agent scoped to write:repository, write:issue, read:user — push branches and open PRs, never merge or administer - add a policy granting read on gitea/creds/unkin-agent, bound to the agents AppRole, mirroring the agent-* Kubernetes creds bindings Depends on terraform-git PR #59: the unkin-agent Gitea account must exist before minted tokens work. The vault-plugin-secrets-gitea engine is already live (plugin v0.1.0 registered, gitea mount configured), so no engine/plugin change is needed here. Reviewed-on: #114 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
15 lines
508 B
YAML
15 lines
508 B
YAML
# Lets the agents AppRole mint ephemeral Gitea tokens for the unkin-agent bot,
|
|
# so AI coding agents authenticate to git.unkin.net as their own least-privilege
|
|
# identity instead of Ben's account. Reading gitea/creds/unkin-agent returns a
|
|
# lease-bound token scoped by the role (write:repository, write:issue, read:user
|
|
# -- never merge/admin). Mirrors the agent-* Kubernetes creds binding pattern.
|
|
---
|
|
rules:
|
|
- path: "gitea/creds/unkin-agent"
|
|
capabilities:
|
|
- read
|
|
|
|
auth:
|
|
approle:
|
|
- agents
|