bitborg/bitborg-infra

Bevaka

Avgrena 0

fix(signup): kanidm signup provisioning #4

Sammanfogat

supernaut sammanfogade 10 incheckningar från feat/kanidm-web-provisioning in i main

2026-06-26 21:33:50 +00:00

supernaut kommenterad

2026-06-26 21:00:39 +00:00

Ägare

Ingen beskrivning angiven.

supernaut lade till 7 incheckningar

2026-06-26 21:00:39 +00:00

feat(kanidm): declare gitborg-web sign-up service account (ADR 0014 Phase 2) 5917754b9f

Adds the gitborg-web-provision service account + privilege-group memberships to the
kanidm-provision state, and defaults for it. Token bootstrap + apply are operator steps
(runbook). Privilege grant and kanidm-provision service-account schema are flagged for
verification against the live instance.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(kanidm): grant gitborg-web-provision idm_people_on_boarding for reset links f32aa4e189

The credential update-intent (reset-link) step is the most user-visible part of
sign-up, and the existing onboarding service account uses idm_people_on_boarding
specifically to mint those intents (reset-links.yml). Granting it directly rather
than assuming idm_people_admins subsumes it. Additive (overwriteMembers:false).
Scoped-ACP narrowing remains the hardening follow-up; still verify on the live
instance during the operator dry-run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(web): inject Kanidm provisioning config; drop dead Forgejo token (ADR 0014 Phase 2) ec56430f30

Web container now gets KANIDM_API_URL (https://kanidm:8443, TLS verified via the self-signed
chain trusted through NODE_EXTRA_CA_CERTS), KANIDM_PUBLIC_URL, KANIDM_TIER_GROUP, and the
write-scoped provision token (podman secret, gated on the vault var). Removes the now-unused
FORGEJO_BASE_URL env + FORGEJO_ADMIN_TOKEN secret from the web role (gitborg-web no longer calls
Forgejo at sign-up — least privilege). Reachability + chain-mount path flagged for operator
verification.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs: record Kanidm sign-up provisioning (ADR 0014 Phase 2) + runbook bootstrap bc4d42a256

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs: fix runbook verify block — reset intent is POST, add KANIDM_API_URL + --resolve 1fbb89efea

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs: add web provision token to vault.example; fix stale forgejo-token notes (final-review) 476f28359f

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore: update gitignore 6fcecd7edc

supernaut lade till 2 incheckningar

2026-06-26 21:15:26 +00:00

docs: set correct kanidm flag for read write f88ff88fcb

chore: update vault dad88bed1d

supernaut lade till 1 incheckning

2026-06-26 21:33:04 +00:00

docs: adjust kanidm flags e0566c3d22

supernaut sammanfogade incheckning 1860fe91a5 till main

2026-06-26 21:33:50 +00:00

supernaut tog bort grenen feat/kanidm-web-provisioning

2026-06-26 21:33:50 +00:00

supernaut refererade denna ändringsförfrågan från en incheckning

2026-06-26 21:33:51 +00:00

fix(signup): kanidm signup provisioning (#4)

supernaut refererade till denna ändringsförfrågan

2026-07-11 20:18:25 +00:00

feat(backup): weekly end-to-end restore drill #66

supernaut refererade denna ändringsförfrågan från en incheckning

2026-07-11 20:40:35 +00:00

feat(backup): weekly end-to-end restore drill (#66)

supernaut refererade denna ändringsförfrågan från en incheckning

2026-08-03 09:41:33 +00:00

fix(signup): kanidm signup provisioning (#4)

supernaut refererade denna ändringsförfrågan från en incheckning

2026-08-03 09:41:33 +00:00

feat(backup): weekly end-to-end restore drill (#66)

Logga in för att delta i denna konversation.

Inga granskare

Ingen milstolpe

Inget projekt

Inga tilldelade

1 deltagare

Notiser

Förfallodatum

Förfallodatumet är ogiltigt eller utanför gränserna. Använd formatet "åååå-mm-dd".

Inget förfallodatum satt.

Beroenden

Inga beroenden satta

Referens

bitborg/bitborg-infra!4

Ingen beskrivning angiven.

Rader
Kolumner