Initial vault-plugin-secrets-gitea engine #1

2026-07-27T00:56:14+10:00

unkinben commented

2026-07-27 00:56:14 +10:00

Adds a Vault/OpenBao secrets engine that mints ephemeral, scoped Gitea access tokens on demand, so static Gitea bot users (teabot personalities, CI identities) never hold standing tokens. The engine is seeded with one Gitea site-admin Basic-Auth credential and, per role, mints a fresh per-user token via the admin API, bound to a Vault lease and deleted from Gitea on revocation. Gitea rejects token auth for token management and only a site admin may manage other users' tokens (reqSelfOrAdmin), which is why the seed is an admin username+password; Gitea tokens never expire server-side, so the Vault lease is the sole expiry mechanism.

add backend wiring plus config (with rotate-root), roles, and creds paths
add the Gitea client: Basic-Auth token create/delete and admin password rotation
add scope validation against Gitea's access-token scope set
add unit tests against a fake Gitea API and a Vault+OpenBao Docker e2e harness
add Makefile, nfpm RPM packaging, and Woodpecker build/test/release pipelines

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

Adds a Vault/OpenBao secrets engine that mints ephemeral, scoped Gitea access tokens on demand, so static Gitea bot users (teabot personalities, CI identities) never hold standing tokens. The engine is seeded with one Gitea site-admin Basic-Auth credential and, per role, mints a fresh per-user token via the admin API, bound to a Vault lease and deleted from Gitea on revocation. Gitea rejects token auth for token management and only a site admin may manage other users' tokens (reqSelfOrAdmin), which is why the seed is an admin username+password; Gitea tokens never expire server-side, so the Vault lease is the sole expiry mechanism. - add backend wiring plus config (with rotate-root), roles, and creds paths - add the Gitea client: Basic-Auth token create/delete and admin password rotation - add scope validation against Gitea's access-token scope set - add unit tests against a fake Gitea API and a Vault+OpenBao Docker e2e harness - add Makefile, nfpm RPM packaging, and Woodpecker build/test/release pipelines https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

unkinben added 2 commits 2026-07-27 00:56:14 +10:00

Initial vault-plugin-secrets-gitea engine 20613afb26

Add a Vault/OpenBao secrets engine that mints ephemeral, scoped Gitea
access tokens on demand. The engine holds a single seeded Gitea site-admin
Basic-Auth credential and, per role, mints a fresh per-user token via the
admin API, bound to a Vault lease and deleted from Gitea on revocation.
Gitea requires Basic Auth for token management (token auth is rejected),
and reqSelfOrAdmin lets a site admin manage any user's tokens, which is the
mechanism this relies on. Gitea tokens never expire server-side, so the
Vault lease is the sole expiry mechanism.

- add backend wiring, config (+ rotate-root), roles, creds paths
- add the gitea client (Basic Auth create/delete token, admin password change)
- add scope validation against Gitea's access-token scope set
- add unit tests (fake Gitea API) and a Vault+OpenBao e2e harness
- add Makefile, nfpm RPM packaging, and Woodpecker build/test/release pipelines

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

Merge auto-init main into gitea engine branch

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

7d95ab6a1e

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

benvin merged commit c9ee758055 into main

2026-07-27 17:11:23 +10:00

benvin deleted branch benvin/gitea-initial

2026-07-27 17:11:23 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-plugin-secrets-gitea#1