Scaffold vault-plugin-secrets-arrstack engine #1

2026-08-18T21:52:51+10:00

unkin-agent commented

2026-08-18 21:52:51 +10:00

Why

arrproxy fronts the *arr apps (Sonarr/Radarr/Prowlarr) behind an OAuth-gated proxy whose human token path derives scope from identity headers, so a non-interactive caller cannot use it. This engine mints DYNAMIC arrproxy machine tokens via arrproxy's bearer-gated admin API (locked by arrproxy PR #2), giving Terraform-driven *arr onboarding a way to issue and revoke per-role tokens without a human in the loop. Each token is a Vault lease: revoke disables it in arrproxy.

Changes

Add the arrstack secrets backend (backend.go) mirroring the sibling vault-plugin-secrets-litellm engine; the same binary runs on Vault and OpenBao.
Add config (base_url, write-only admin_token, optional ca_cert PEM, request_timeout_seconds); client.go sends Authorization: Bearer <admin_token>.
Add roles/<name> with apps (non-empty subset of sonarr/radarr/prowlarr, de-duplicated and sorted), ttl, max_ttl.
Add creds/<name>: POST /api/admin/tokens with subject vault:arrstack:<role> and ttl_seconds from the effective lease TTL; return token, id, apps; store id for revocation.
Revoke via DELETE /api/admin/tokens/{id} (idempotent); cap lease renewal at the arrproxy token's fixed expiry (honouring max_ttl), documented in the README.
Add table-driven unit tests against a fake arrproxy admin server covering mint/revoke/renew, config/role validation, apps-subset enforcement, and subject-prefix correctness.
Add Makefile (build + make patch|minor|major), nfpm packaging installing the binary to /opt/{vault,openbao}-plugins, and pre-commit/build/test plus a tag-triggered release pipeline that builds the RPM, PUTs it to artifactapi rpm-internal, and prints the binary sha256 for Puppet plugin registration.

go build, go vet, gofmt -l, and go test -race are clean.

## Why arrproxy fronts the *arr apps (Sonarr/Radarr/Prowlarr) behind an OAuth-gated proxy whose human token path derives scope from identity headers, so a non-interactive caller cannot use it. This engine mints DYNAMIC arrproxy machine tokens via arrproxy's bearer-gated admin API (locked by arrproxy PR #2), giving Terraform-driven *arr onboarding a way to issue and revoke per-role tokens without a human in the loop. Each token is a Vault lease: revoke disables it in arrproxy. ## Changes - Add the `arrstack` secrets backend (backend.go) mirroring the sibling `vault-plugin-secrets-litellm` engine; the same binary runs on Vault and OpenBao. - Add `config` (base_url, write-only admin_token, optional ca_cert PEM, request_timeout_seconds); client.go sends `Authorization: Bearer <admin_token>`. - Add `roles/<name>` with `apps` (non-empty subset of sonarr/radarr/prowlarr, de-duplicated and sorted), `ttl`, `max_ttl`. - Add `creds/<name>`: POST `/api/admin/tokens` with subject `vault:arrstack:<role>` and ttl_seconds from the effective lease TTL; return `token`, `id`, `apps`; store `id` for revocation. - Revoke via DELETE `/api/admin/tokens/{id}` (idempotent); cap lease renewal at the arrproxy token's fixed expiry (honouring max_ttl), documented in the README. - Add table-driven unit tests against a fake arrproxy admin server covering mint/revoke/renew, config/role validation, apps-subset enforcement, and subject-prefix correctness. - Add Makefile (build + make patch|minor|major), nfpm packaging installing the binary to /opt/{vault,openbao}-plugins, and pre-commit/build/test plus a tag-triggered release pipeline that builds the RPM, PUTs it to artifactapi rpm-internal, and prints the binary sha256 for Puppet plugin registration. `go build`, `go vet`, `gofmt -l`, and `go test -race` are clean.

unkin-agent added 1 commit 2026-08-18 21:52:51 +10:00

Scaffold vault-plugin-secrets-arrstack engine

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

3418cfd8f6

Mint dynamic arrproxy machine tokens via arrproxy's bearer-gated admin API
so Terraform-driven *arr onboarding can issue and revoke per-role tokens
non-interactively.

- Add backend, config, roles, creds paths and the arrstack_token secret
- Call POST/DELETE /api/admin/tokens with a vault:arrstack:<role> subject
- Enforce apps as a non-empty subset of sonarr/radarr/prowlarr
- Cap lease renewal at the arrproxy token's fixed expiry
- Add table-driven unit tests against a fake arrproxy admin server
- Add Makefile, nfpm packaging, and pre-commit/build/test/release pipelines

benvin merged commit c3205dde45 into main

2026-08-18 22:37:25 +10:00

benvin deleted branch benvin/scaffold-engine

2026-08-18 22:37:26 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-plugin-secrets-arrstack#1