Every token this engine mints is as powerful as the apps it can reach: a
read-only integration can still write to the *arr. arrproxy v0.5.0 accepts
a method scope at mint time, so let a role pin its tokens to it.
- Add an optional role field methods, uppercase-normalized, de-duplicated
and validated against the known HTTP methods at role write.
- Forward the role's scope as methods on the arrproxy mint request and
echo it in the creds response alongside apps/subject.
- Omit the field entirely when a role has no scope, so an arrproxy
predating method scoping sees an unchanged request.
- Cover normalization, rejection, pass-through and the unscoped case.
Mint dynamic arrproxy machine tokens via arrproxy's bearer-gated admin API
so Terraform-driven *arr onboarding can issue and revoke per-role tokens
non-interactively.
- Add backend, config, roles, creds paths and the arrstack_token secret
- Call POST/DELETE /api/admin/tokens with a vault:arrstack:<role> subject
- Enforce apps as a non-empty subset of sonarr/radarr/prowlarr
- Cap lease renewal at the arrproxy token's fixed expiry
- Add table-driven unit tests against a fake arrproxy admin server
- Add Makefile, nfpm packaging, and pre-commit/build/test/release pipelines
unkin-agent