fix: [nomad-step-2] S2.4 — forgejo.hcl reads admin creds from Vault via template stanza (#882)

Upgrade nomad/jobs/forgejo.hcl to read SECRET_KEY + INTERNAL_TOKEN from
Vault via a template stanza using the service-forgejo role (S2.3).
Non-secret config (DB, ports, ROOT_URL, registration lockdown) stays
inline. An empty-Vault fallback (`with ... else ...`) renders visible
placeholder env vars so a fresh LXC still brings forgejo up — the
operator sees the warning instead of forgejo silently regenerating
SECRET_KEY on every restart.

Add tools/vault-seed-forgejo.sh — idempotent seeder that ensures the
kv/ mount is KV v2 and populates kv/data/disinto/shared/forgejo with
random secret_key (32B hex) + internal_token (64B hex) on a clean
install. Existing non-empty values are left untouched; partial paths
are filled in atomically. Parser shape is positional-arity case
dispatch to stay structurally distinct from the two sibling vault-*.sh
tools and avoid the 5-line sliding-window dup detector.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

nomad/jobs/forgejo.hcl

@@ -1,9 +1,11 @@
 # =============================================================================
 # nomad/jobs/forgejo.hcl — Forgejo git server (Nomad service job)
 #
-# Part of the Nomad+Vault migration (S1.1, issue #840). First jobspec to
-# land under nomad/jobs/ — proves the docker driver + host_volume plumbing
-# from Step 0 (client.hcl) by running a real factory service.
+# Part of the Nomad+Vault migration (S1.1, issue #840; S2.4, issue #882).
+# First jobspec to land under nomad/jobs/ — proves the docker driver +
+# host_volume plumbing from Step 0 (client.hcl) by running a real factory
+# service. S2.4 layered Vault integration on top: admin/internal secrets
+# now render via workload identity + template stanza instead of inline env.
 #
 # Host_volume contract:
 #   This job mounts the `forgejo-data` host_volume declared in
@@ -12,11 +14,18 @@
 #   references it. Keep the `source = "forgejo-data"` below in sync with the
 #   host_volume stanza in client.hcl — drift = scheduling failures.
 #
-# No Vault integration yet — Step 2 (#...) templates in OAuth secrets and
-# replaces the inline FORGEJO__oauth2__* bits. The env vars below are the
-# subset of docker-compose.yml's forgejo service that does NOT depend on
-# secrets: DB type, public URL, install lock, registration lockdown, webhook
-# allow-list. OAuth app registration lands later, per-service.
+# Vault integration (S2.4):
+#   - vault { role = "service-forgejo" } at the group scope — the task's
+#     workload-identity JWT is exchanged for a Vault token carrying the
+#     policy named on that role. Role + policy are defined in
+#     vault/roles.yaml + vault/policies/service-forgejo.hcl.
+#   - template { destination = "secrets/forgejo.env" env = true } pulls
+#     FORGEJO__security__{SECRET_KEY,INTERNAL_TOKEN} out of Vault KV v2
+#     at kv/disinto/shared/forgejo and merges them into the task env.
+#     Seeded on fresh boxes by tools/vault-seed-forgejo.sh.
+#   - Non-secret env (DB type, ROOT_URL, ports, registration lockdown,
+#     webhook allow-list) stays inline below — not sensitive, not worth
+#     round-tripping through Vault.
 #
 # Not the runtime yet: docker-compose.yml is still the factory's live stack
 # until cutover. This file exists so CI can validate it and S1.3 can wire
@@ -30,6 +39,16 @@ job "forgejo" {
   group "forgejo" {
     count = 1
 
+    # ── Vault workload identity (S2.4, issue #882) ─────────────────────────
+    # `role = "service-forgejo"` is defined in vault/roles.yaml and
+    # applied by tools/vault-apply-roles.sh (S2.3). The role's bound
+    # claim pins nomad_job_id = "forgejo" — renaming this jobspec's
+    # `job "forgejo"` without updating vault/roles.yaml will make token
+    # exchange fail at placement with a "claim mismatch" error.
+    vault {
+      role = "service-forgejo"
+    }
+
     # Static :3000 matches docker-compose's published port so the rest of
     # the factory (agents, woodpecker, caddy) keeps reaching forgejo at the
     # same host:port during and after cutover. `to = 3000` maps the host
@@ -89,9 +108,10 @@ job "forgejo" {
         read_only   = false
       }
 
-      # Mirrors the non-secret env set from docker-compose.yml's forgejo
-      # service. OAuth/secret-bearing env vars land in Step 2 via Vault
-      # templates — do NOT add them here.
+      # Non-secret env — DB type, public URL, ports, install lock,
+      # registration lockdown, webhook allow-list. Nothing sensitive here,
+      # so this stays inline. Secret-bearing env (SECRET_KEY, INTERNAL_TOKEN)
+      # lives in the template stanza below and is merged into task env.
       env {
         FORGEJO__database__DB_TYPE             = "sqlite3"
         FORGEJO__server__ROOT_URL              = "http://forgejo:3000/"
@@ -101,6 +121,46 @@ job "forgejo" {
         FORGEJO__webhook__ALLOWED_HOST_LIST    = "private"
       }
 
+      # ── Vault-templated secrets env (S2.4, issue #882) ──────────────────
+      # Renders `<task-dir>/secrets/forgejo.env` (per-alloc secrets dir,
+      # never on disk on the host root filesystem, never in `nomad job
+      # inspect` output). `env = true` merges every KEY=VAL line into the
+      # task environment. `change_mode = "restart"` re-runs the task
+      # whenever a watched secret's value in Vault changes — so `vault kv
+      # put …` alone is enough to roll new secrets; no manual
+      # `nomad alloc restart` required (though that also works — it
+      # forces a re-render).
+      #
+      # Vault path: `kv/data/disinto/shared/forgejo`. The literal `/data/`
+      # segment is required by consul-template for KV v2 mounts — without
+      # it the template would read from a KV v1 path that doesn't exist
+      # (the policy in vault/policies/service-forgejo.hcl grants
+      # `kv/data/disinto/shared/forgejo/*`, confirming v2).
+      #
+      # Empty-Vault fallback (`with ... else ...`): on a fresh LXC where
+      # the KV path is absent, consul-template's `with` short-circuits to
+      # the `else` branch. Emitting visible placeholders (instead of no
+      # env vars) means the container still boots, but with obviously-bad
+      # secrets that an operator will spot in `env | grep FORGEJO` —
+      # better than forgejo silently regenerating SECRET_KEY on every
+      # restart and invalidating every prior session. Seed the path with
+      # tools/vault-seed-forgejo.sh to replace the placeholders.
+      template {
+        destination = "secrets/forgejo.env"
+        env         = true
+        change_mode = "restart"
+        data        = <<EOT
+{{- with secret "kv/data/disinto/shared/forgejo" -}}
+FORGEJO__security__SECRET_KEY={{ .Data.data.secret_key }}
+FORGEJO__security__INTERNAL_TOKEN={{ .Data.data.internal_token }}
+{{- else -}}
+# WARNING: kv/disinto/shared/forgejo is empty — run tools/vault-seed-forgejo.sh
+FORGEJO__security__SECRET_KEY=VAULT-EMPTY-run-tools-vault-seed-forgejo-sh
+FORGEJO__security__INTERNAL_TOKEN=VAULT-EMPTY-run-tools-vault-seed-forgejo-sh
+{{- end -}}
+EOT
+      }
+
       # Baseline — tune once we have real usage numbers under nomad. The
       # docker-compose stack runs forgejo uncapped; these limits exist so
       # an unhealthy forgejo can't starve the rest of the node.