[nomad-step-2] S2.1 — vault/policies/*.hcl + tools/vault-apply-policies.sh #879

New issue

Closed

opened 2026-04-16 15:26:33 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-16 15:26:33 +00:00

Collaborator

Part of the Nomad+Vault migration. Step 2 — Vault policies + workload identity + secrets import.

Goal

Land the Vault policy HCL files and an idempotent apply script. This is the authorization layer that later steps (S2.4, Step 5 vault-runner, Step 6 chat auth) all depend on.

Scope

Create:

vault/policies/service-forgejo.hcl — read kv/disinto/shared/forgejo/* (admin password, OAuth config once that lands).
vault/policies/service-woodpecker.hcl — read kv/disinto/shared/woodpecker/* (agent secret, forge OAuth client).
vault/policies/bot-dev.hcl, bot-review.hcl, bot-gardener.hcl, bot-architect.hcl, bot-planner.hcl, bot-predictor.hcl, bot-supervisor.hcl, bot-vault.hcl, bot-dev-qwen.hcl — each reads own kv/disinto/bots/<name>/* + shared forge URL at kv/disinto/shared/forge/*.
vault/policies/runner-GITHUB_TOKEN.hcl, runner-CODEBERG_TOKEN.hcl, runner-CLAWHUB_TOKEN.hcl, runner-DEPLOY_KEY.hcl, runner-NPM_TOKEN.hcl, runner-DOCKER_HUB_TOKEN.hcl — each grants read on exactly one KV path. One policy per declarable secret; vault-runner Step 5 composes them per-dispatch.
vault/policies/dispatcher.hcl — read all kv/disinto/runner/* + read kv/disinto/shared/ops-repo/*.

Create tools/vault-apply-policies.sh:

Reads vault/policies/*.hcl, for each file calls vault policy write <basename> <file> via lib/hvault.sh::hvault_policy_apply (landed by P4).
Idempotent — re-running with unchanged files is a no-op reported as [vault-apply] policy X unchanged.
--dry-run flag: prints each policy name + SHA it would write, exits 0.
Diffs existing policy content before writing so unchanged policies report unchanged rather than updated.

Acceptance criteria

All policy HCL files parse clean (checked by Step 2's CI extension, landed later in S2.6).
tools/vault-apply-policies.sh against a Step-0-initialized Vault:
- First run: all policies created, each reported as [vault-apply] policy X created.
- Second run: all policies unchanged, each reported [vault-apply] policy X unchanged.
- With --dry-run: prints planned work, changes nothing.
shellcheck clean.
Documented in new vault/policies/AGENTS.md (short): naming convention, what each policy grants, how to add a new one.

Non-goals

Not enabling Vault JWT auth (S2.3).
Not writing any secrets to KV (S2.2).
Not attaching policies to Nomad jobs (S2.4).

Labels / meta

[nomad-step-2] S2.1 — no dependencies.

Part of the Nomad+Vault migration. **Step 2 — Vault policies + workload identity + secrets import.** ## Goal Land the Vault policy HCL files and an idempotent apply script. This is the authorization layer that later steps (S2.4, Step 5 vault-runner, Step 6 chat auth) all depend on. ## Scope Create: - `vault/policies/service-forgejo.hcl` — read `kv/disinto/shared/forgejo/*` (admin password, OAuth config once that lands). - `vault/policies/service-woodpecker.hcl` — read `kv/disinto/shared/woodpecker/*` (agent secret, forge OAuth client). - `vault/policies/bot-dev.hcl`, `bot-review.hcl`, `bot-gardener.hcl`, `bot-architect.hcl`, `bot-planner.hcl`, `bot-predictor.hcl`, `bot-supervisor.hcl`, `bot-vault.hcl`, `bot-dev-qwen.hcl` — each reads own `kv/disinto/bots/<name>/*` + shared forge URL at `kv/disinto/shared/forge/*`. - `vault/policies/runner-GITHUB_TOKEN.hcl`, `runner-CODEBERG_TOKEN.hcl`, `runner-CLAWHUB_TOKEN.hcl`, `runner-DEPLOY_KEY.hcl`, `runner-NPM_TOKEN.hcl`, `runner-DOCKER_HUB_TOKEN.hcl` — each grants read on exactly one KV path. One policy per declarable secret; vault-runner Step 5 composes them per-dispatch. - `vault/policies/dispatcher.hcl` — read all `kv/disinto/runner/*` + read `kv/disinto/shared/ops-repo/*`. Create `tools/vault-apply-policies.sh`: - Reads `vault/policies/*.hcl`, for each file calls `vault policy write <basename> <file>` via `lib/hvault.sh::hvault_policy_apply` (landed by P4). - Idempotent — re-running with unchanged files is a no-op reported as `[vault-apply] policy X unchanged`. - `--dry-run` flag: prints each policy name + SHA it would write, exits 0. - Diffs existing policy content before writing so unchanged policies report `unchanged` rather than `updated`. ## Acceptance criteria - All policy HCL files parse clean (checked by Step 2's CI extension, landed later in S2.6). - `tools/vault-apply-policies.sh` against a Step-0-initialized Vault: - First run: all policies created, each reported as `[vault-apply] policy X created`. - Second run: all policies unchanged, each reported `[vault-apply] policy X unchanged`. - With `--dry-run`: prints planned work, changes nothing. - `shellcheck` clean. - Documented in new `vault/policies/AGENTS.md` (short): naming convention, what each policy grants, how to add a new one. ## Non-goals - Not enabling Vault JWT auth (S2.3). - Not writing any secrets to KV (S2.2). - Not attaching policies to Nomad jobs (S2.4). ## Labels / meta - `[nomad-step-2] S2.1` — no dependencies.