From 700e4ce15afcae73845ac3c0c74f235c696ccd04 Mon Sep 17 00:00:00 2001
From: Lutz Finsterle <lutz.finsterle@t-online.de>
Date: Sat, 1 Aug 2026 10:00:07 +0200
Subject: [PATCH] Add smtp-healthcheck-ro policy (scoped read for ClaudeAdmin
 SMTP creds)

Read-only access to secret/data/smtp/healthcheck, consumed by the ClaudeAdmin
healthcheck email notifier via a periodic token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 policies/smtp-healthcheck-ro.hcl | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 policies/smtp-healthcheck-ro.hcl

diff --git a/policies/smtp-healthcheck-ro.hcl b/policies/smtp-healthcheck-ro.hcl
new file mode 100644
index 0000000..a106870
--- /dev/null
+++ b/policies/smtp-healthcheck-ro.hcl
@@ -0,0 +1,6 @@
+# Read-only access to the SMTP credentials used by the ClaudeAdmin healthcheck
+# email notifier (run-healthcheck.sh). Scoped to exactly one KV v2 path.
+# Consumed via a periodic token at ~/.config/openbao/healthcheck-smtp.token.
+path "secret/data/smtp/healthcheck" {
+  capabilities = ["read"]
+}