lutz/OpenBAO
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: lutz:af31208251983000339cd228845d80f50ab7a77e
Branches Tags
lutz:main
...
compare: lutz:63f864b68b0fc404ec410cf80191ab6332867e93
Branches Tags
lutz:main

3 Commits
af31208251 ... 63f864b68b

Author SHA1 Message Date
Lutz Finsterle
63f864b68b gitignore: cover *-credentials.txt (operator login creds) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-08-01 10:04:13 +02:00
Lutz Finsterle
f12034bab9 apply-policies: fix header always showing [dry-run] 
${DRY:+...} expanded on DRY=0 (non-empty). Gate the label on DRY=1 instead;
the apply logic was already correct.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-08-01 10:03:12 +02:00
Lutz Finsterle
700e4ce15a Add smtp-healthcheck-ro policy (scoped read for ClaudeAdmin SMTP creds) 
Read-only access to secret/data/smtp/healthcheck, consumed by the ClaudeAdmin
healthcheck email notifier via a periodic token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-08-01 10:00:07 +02:00
3 changed files with 8 additions and 1 deletions
Expand all files Collapse all files

1
.gitignore vendored
View File

@@ -10,3 +10,4 @@ data/
.env
artifacts/
.claude/
*-credentials.txt

6
policies/smtp-healthcheck-ro.hcl Normal file
View File

@@ -0,0 +1,6 @@
# Read-only access to the SMTP credentials used by the ClaudeAdmin healthcheck
# email notifier (run-healthcheck.sh). Scoped to exactly one KV v2 path.
# Consumed via a periodic token at ~/.config/openbao/healthcheck-smtp.token.
path "secret/data/smtp/healthcheck" {
capabilities = ["read"]
}

2
scripts/apply-policies.sh
View File

@@ -20,7 +20,7 @@ TOKEN="${BAO_TOKEN:-}"
# functional comparison: ignore comments and blank lines
norm(){ grep -vE '^[[:space:]]*#' | grep -vE '^[[:space:]]*$' | sed 's/[[:space:]]*$//'; }
echo "${DRY:+[dry-run] }policies under $DIR -> $ADDR"
echo "$([ "$DRY" = 1 ] && printf '[dry-run] ')policies under $DIR -> $ADDR"
for f in "$DIR"/*.hcl; do
name="$(basename "$f" .hcl)"; filetxt="$(cat "$f")"
live="$(curl -sS -H "X-Vault-Token: $TOKEN" "$ADDR/v1/sys/policies/acl/$name" \