6bd07d33cb
Phase 1 of moving the secret store to OpenBao. Nothing is cut over: TG_SECRETS_BACKEND defaults to sops for all three environments, so SOPS remains authoritative until an environment is flipped in a reviewed PR. The reason for the migration is one specific failure class. infra/CLAUDE.md requires that vps1 never hold prod credentials, but that rule is currently enforced by a caller-side shell flag (THERMOGRAPH_SECRETS_SKIP_COMMON) at three call sites. A fourth call site, or one by-hand render, writes both S3 keypairs, the VAPID private key, REGISTRY_TOKEN and the IndexNow/metrics tokens onto the Forgejo CI-runner box and exits 0. policies/tg-host-dev.hcl makes that a 403 instead: dev's identity cannot read the common path at all. Shape: - vps2 only, native systemd (not a container: a Swarm service is circular, and a plain docker run is one `prune -a` from gone), raft storage (2.6.0 deprecated the file backend), static auto-unseal so a reboot cannot block deploys, mesh-only self-signed TLS (not ACME — that would put DNS in the boot chain of the secret store). - AppRole per environment, CIDR-bound, 5-minute tokens. Each environment's secret-id is owned by its own deploy user, which is a boundary that does not exist today since prod and beta both reach the same root-owned age key. - Render still produces the same raw unquoted dotenv: Centralis compares /etc/thermograph.env textually and the Swarm entrypoint parses it by line. The backend dispatch in render-secrets.sh returns early rather than refactoring the shared write path, so the SOPS path stays byte-identical. Verified by rendering dev (12 keys) and prod (32 keys) through it, matching the live hosts. The duplicated write path is noted for consolidation once prod has been on OpenBao for a release cycle. The OpenBao renderer rejects values containing a newline or a shell metacharacter. /etc/thermograph.env is sourced by bash in six places, so such a value is a command-execution path on the deploy host; the SOPS path has always had this hazard and avoids it only because every current value happens to be alphanumeric. Also records that the age keypair is NOT retired by this migration: it is the backup encryption key for every off-box dump (ops-cron.yml:142,197, 30-day retention), so deleting it with the vault files would silently destroy a month of database recoverability. verify-parity.sh is the cutover gate — it renders both backends and diffs them, reporting key names and counts only, never values.
72 lines
2.8 KiB
HCL
72 lines
2.8 KiB
HCL
// Policy for the DEV host's render identity (vps1).
|
|
//
|
|
// THIS FILE IS THE POINT OF THE MIGRATION.
|
|
//
|
|
// infra/CLAUDE.md states the rule: "vps1 must never hold prod credentials. It's the
|
|
// box that runs Forgejo, its CI runner, and dev's unreviewed branch — the opposite of
|
|
// an isolation boundary."
|
|
//
|
|
// Today that rule is enforced by a SHELL FLAG (THERMOGRAPH_SECRETS_SKIP_COMMON=1) set
|
|
// by the *caller*, at three separate call sites: env-topology.sh:196 -> deploy.sh:67,
|
|
// deploy-dev.sh:86, and infra-sync.yml:93-95. The renderer itself does not know that
|
|
// env=dev means never-common. A fourth call site, or one by-hand
|
|
// `render_thermograph_secrets /opt/thermograph-dev/infra dev`, writes both S3
|
|
// keypairs (one read-write on the bucket holding prod's database backups), the VAPID
|
|
// private key that signs Web Push to real subscribers, REGISTRY_TOKEN, and the
|
|
// IndexNow and metrics tokens onto the Forgejo CI-runner box — and exits 0.
|
|
//
|
|
// Under this policy that is no longer possible to get wrong. dev's identity cannot
|
|
// read the common path. A misconfigured caller gets a 403 from OpenBao, not a silent
|
|
// success with production credentials on disk. The failure class is gone, not guarded.
|
|
|
|
// dev's own values. This is the ONLY secret path dev can read.
|
|
path "thermograph/data/env/dev" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "thermograph/metadata/env/dev" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
|
|
// EXPLICIT DENY on the shared production credential set.
|
|
//
|
|
// A deny rule is redundant with OpenBao's default-deny — anything not granted is
|
|
// already refused. It is here anyway, and must stay, for two reasons:
|
|
// 1. It is documentation that survives refactoring. Someone widening dev's grants
|
|
// has to delete an explicit deny to break the rule, which is a much louder edit
|
|
// than adding a path to an allow list.
|
|
// 2. In OpenBao, a deny on a path beats any grant at that path regardless of rule
|
|
// order or specificity. So if dev's identity is ever accidentally given a
|
|
// broader policy alongside this one, this still wins.
|
|
path "thermograph/data/common" {
|
|
capabilities = ["deny"]
|
|
}
|
|
|
|
path "thermograph/metadata/common" {
|
|
capabilities = ["deny"]
|
|
}
|
|
|
|
// Deny the other environments outright. Same argument: dev has no business reading
|
|
// beta or prod, and being explicit means a widened grant elsewhere cannot silently
|
|
// re-open it.
|
|
path "thermograph/data/env/prod" {
|
|
capabilities = ["deny"]
|
|
}
|
|
|
|
path "thermograph/data/env/beta" {
|
|
capabilities = ["deny"]
|
|
}
|
|
|
|
path "thermograph/data/centralis/*" {
|
|
capabilities = ["deny"]
|
|
}
|
|
|
|
// Token self-management, so the render can look up and renew its own lease without
|
|
// needing a broader grant.
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/renew-self" {
|
|
capabilities = ["update"]
|
|
}
|