Lutz Finsterle
37a97cb0f4
Store the gitea PAT in OpenBAO KV (secret/gitea/push) and fetch it via a git credential helper instead of keeping it in ~/.git-credentials: - scripts/git-credential-openbao.sh: helper that reads the cred from the OpenBAO API using a scoped, read-only periodic token - scripts/store-gitea-cred.sh: one-time hidden-input store of the PAT - README: usage + rotation notes Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
849 B
Bash
Executable File
21 lines
849 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# git credential helper backed by OpenBAO KV (secret/gitea/push).
|
|
# Configured per-host (see README), so it only answers for the gitea remote.
|
|
# git invokes it as: git-credential-openbao.sh get (request on stdin)
|
|
set -euo pipefail
|
|
|
|
[ "${1:-}" = "get" ] || exit 0 # we only serve credentials; ignore store/erase
|
|
|
|
ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
|
|
TOKF="${OPENBAO_GIT_TOKEN_FILE:-$HOME/.config/openbao/git-cred.token}"
|
|
[ -r "$TOKF" ] || exit 0
|
|
TOK="$(cat "$TOKF")"
|
|
|
|
resp="$(curl -sS --max-time 5 -H "X-Vault-Token: ${TOK}" \
|
|
"${ADDR}/v1/secret/data/gitea/push" 2>/dev/null)" || exit 0
|
|
user="$(printf '%s' "$resp" | jq -r '.data.data.username // empty')"
|
|
pass="$(printf '%s' "$resp" | jq -r '.data.data.token // empty')"
|
|
[ -n "$user" ] && [ -n "$pass" ] || exit 0
|
|
|
|
printf 'username=%s\npassword=%s\n' "$user" "$pass"
|