45 lines
1.2 KiB
HCL
45 lines
1.2 KiB
HCL
|
// Policy for PROD's render identity on vps2.
|
||
|
|
//
|
||
|
|
// Reads the shared set plus prod's own overrides — the OpenBao equivalent of
|
||
|
|
// "common.yaml then prod.yaml, last-wins".
|
||
|
|
//
|
||
|
|
// Note what this policy does NOT grant: beta. vps2 runs prod and beta side by side
|
||
|
|
// with one filesystem and one SSH credential, so the host is emphatically not an
|
||
|
|
// isolation boundary between them (infra/CLAUDE.md is explicit about this). Separate
|
||
|
|
// identities with separate policies do not fix that — a foothold on the box can read
|
||
|
|
// both AppRole credentials — but they do mean a *mistake* cannot cross the line:
|
||
|
|
// prod's render cannot accidentally pull beta's database password, and the audit log
|
||
|
|
// attributes every read to one environment or the other.
|
||
|
|
|
||
|
|
path "thermograph/data/common" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/metadata/common" {
|
||
|
|
capabilities = ["read", "list"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/data/env/prod" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/metadata/env/prod" {
|
||
|
|
capabilities = ["read", "list"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/data/env/beta" {
|
||
|
|
capabilities = ["deny"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/data/env/dev" {
|
||
|
|
capabilities = ["deny"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "auth/token/lookup-self" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "auth/token/renew-self" {
|
||
|
|
capabilities = ["update"]
|
||
|
|
}
|