unkin-agent
3418cfd8f6
Mint dynamic arrproxy machine tokens via arrproxy's bearer-gated admin API so Terraform-driven *arr onboarding can issue and revoke per-role tokens non-interactively. - Add backend, config, roles, creds paths and the arrstack_token secret - Call POST/DELETE /api/admin/tokens with a vault:arrstack:<role> subject - Enforce apps as a non-empty subset of sonarr/radarr/prowlarr - Cap lease renewal at the arrproxy token's fixed expiry - Add table-driven unit tests against a fake arrproxy admin server - Add Makefile, nfpm packaging, and pre-commit/build/test/release pipelines
39 lines
1004 B
YAML
39 lines
1004 B
YAML
---
|
|
# nfpm config for building the vault-plugin-secrets-arrstack RPM.
|
|
# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
|
|
# Built once per target server (Vault, OpenBao); PACKAGE_NAME and
|
|
# PACKAGE_PLUGIN_DIR vary per flavour.
|
|
|
|
name: ${PACKAGE_NAME}
|
|
version: ${PACKAGE_VERSION}
|
|
release: ${PACKAGE_RELEASE}
|
|
arch: ${PACKAGE_ARCH}
|
|
platform: ${PACKAGE_PLATFORM}
|
|
section: default
|
|
priority: extra
|
|
description: "${PACKAGE_DESCRIPTION}"
|
|
|
|
maintainer: ${PACKAGE_MAINTAINER}
|
|
homepage: ${PACKAGE_HOMEPAGE}
|
|
license: ${PACKAGE_LICENSE}
|
|
|
|
disable_globbing: false
|
|
|
|
replaces:
|
|
- ${PACKAGE_NAME}
|
|
provides:
|
|
- ${PACKAGE_NAME}
|
|
|
|
# Install the plugin binary into the server's plugin directory. Point the
|
|
# server's plugin_directory at PACKAGE_PLUGIN_DIR to pick it up.
|
|
contents:
|
|
- src: dist/vault-plugin-secrets-arrstack
|
|
dst: ${PACKAGE_PLUGIN_DIR}/vault-plugin-secrets-arrstack
|
|
file_info:
|
|
mode: 0755
|
|
owner: root
|
|
group: root
|
|
|
|
scripts:
|
|
preinstall: ${PACKAGE_PREINSTALL}
|