HOMELAB-988: feat(forgejo-runner): mount age key + AWS creds + Forgejo token #188

Merged

aaron merged 1 commit from plane/HOMELAB-988-runner-secrets into live

2026-04-26 00:21:50 +00:00

aaron commented

2026-04-26 00:21:48 +00:00

Owner

Third of four PRs for HOMELAB-988. Wires the K8s Forgejo runner with the secrets terraform needs.

3 ExternalSecrets in forgejo-runner ns, sourced from secrets/ ns via existing ClusterSecretStore. Re-uses already-cluster-resident credentials (sops-age-key from prod#264, AWS creds from velero, Forgejo token from dev-agent-credentials) — no new tokens minted.

Deployment.yaml: env vars + volume mounts so terraform finds the age key and AWS creds at standard paths. FORGEJO_TOKEN exposed as env var for the workflow git-auth step (PR-C).

PR-C on prod will: refactor main.tf:84 module source to git URL; update infra-plan.yaml/infra-apply.yaml paths from /home/admin to /home/runner; add a 'configure git auth' step that uses $FORGEJO_TOKEN.

Third of four PRs for HOMELAB-988. Wires the K8s Forgejo runner with the secrets terraform needs. 3 ExternalSecrets in `forgejo-runner` ns, sourced from `secrets/` ns via existing ClusterSecretStore. Re-uses already-cluster-resident credentials (sops-age-key from prod#264, AWS creds from velero, Forgejo token from dev-agent-credentials) — no new tokens minted. Deployment.yaml: env vars + volume mounts so terraform finds the age key and AWS creds at standard paths. FORGEJO_TOKEN exposed as env var for the workflow git-auth step (PR-C). PR-C on prod will: refactor main.tf:84 module source to git URL; update infra-plan.yaml/infra-apply.yaml paths from /home/admin to /home/runner; add a 'configure git auth' step that uses $FORGEJO_TOKEN.

aaron added 1 commit

2026-04-26 00:21:48 +00:00

HOMELAB-988: feat(forgejo-runner): mount age key + AWS creds + Forgejo token

0/0 projects applied successfully.

CI Review / helm-validate (pull_request) Has been cancelled

Details

CI Review / pr-title (pull_request) Has been cancelled

Details

CI Review / ai-review (pull_request) Has been cancelled

Details

Lint & Validate / terraform-validate (pull_request) Has been cancelled

Details

Lint & Validate / yaml-lint (pull_request) Has been cancelled

Details

Lint & Validate / shellcheck (pull_request) Has been cancelled

Details

4b3c62075f

Adds three ExternalSecrets in the forgejo-runner namespace and wires the
runner Pod to consume them, so terraform jobs running on this runner
(`runs-on: infra` per .forgejo/workflows/infra-plan.yaml) have everything
they need to plan/apply the prod cluster terraform.

ExternalSecrets (sourced from `secrets/` ns via the existing
ClusterSecretStore `kubernetes-secrets`):

  - runner-sops-age-key  ← secrets/sops-age-key.keys.txt
       (the SopsSecret CR landed in prod#264 puts the age key here)
  - runner-aws-credentials ← secrets/velero-aws-credentials.cloud
       (re-uses Velero's AWS creds; the `cloud` key is already in
       AWS shared-credentials format which terraform's S3 backend
       and AWS provider both consume)
  - runner-forgejo-token ← secrets/dev-agent-credentials.FORGEJO_TOKEN
       (re-uses the agent-tier Forgejo token. Used by terraform's
       module fetch from aaron/infra-core via git source URL.)

Deployment additions:
  - SOPS_AGE_KEY_FILE=/home/runner/.config/sops/age/keys.txt
  - AWS_SHARED_CREDENTIALS_FILE=/home/runner/.aws/credentials
  - FORGEJO_TOKEN env from runner-forgejo-token Secret
  - Volume mounts for the two file-shaped secrets at the paths above
    (mode 0400 — read-only, owner only).

The workflows in prod/.forgejo/workflows/infra-{plan,apply}.yaml currently
reference `/home/admin/...` paths (mgmt-VM-era). PR-C on prod will swap
those to `/home/runner/...` to match this runner.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>