fix(aosguard): read the admin PAT from SSM like every other credential #1079

Merged

coilysiren merged 1 commit from aos/claude/ym96-admin-ssm into main

2026-08-16 00:33:38 +00:00

coilyco-ops commented

2026-08-16 00:03:34 +00:00

Member

Kai: it is literally just an SSM param. Removing the ceremony an agent built around it.

What was there

auth header-token { value env FORGEJO_ADMIN_TOKEN }. So a caller had to export the token first, which needed a helper to fetch it, which grew a TTY gate so headless callers could not pull it by accident.

Each step was reasonable given the one before it. The first step was the mistake.

What it is now

The same provider ssm block the ordinary Forgejo wrapper has always used, pointed at /forgejo/admin-token and resolved at call time.

provider ssm {
    exec aws ssm get-parameter --with-decryption --output text --query "Parameter.Value" --name
}
auth header-token {
    header Authorization
    prefix "token "
    value ssm "/forgejo/admin-token"
}

Access to the parameter is the boundary. That is where an SSM-backed credential's boundary belongs, and it is enforced by IAM rather than by whether stdin happens to be a terminal.

Verified

$ echo "FORGEJO_ADMIN_TOKEN set? ${FORGEJO_ADMIN_TOKEN:-no}"
FORGEJO_ADMIN_TOKEN set? no
$ ward exec aosguard-run -- ops forgejo-admin org-label list coilyco-flight-deck
org-label list via SSM-backed auth: OK, 11 labels

No env var, no TTY, no wrapper script.

Follow-on, not in this PR

infrastructure/scripts/forgejo-admin-token.py and its ~10 callers are the other half. They fetch the token to hand to raw curl, and several of them predate the guarded verbs entirely. Filed separately so this change can land on its own.

Docs

docs/aosguard-forgejo-admin.md gains a Credentials section and loses "attended" from its title, since the wrapper is no longer gated on a terminal.

🤖 Generated with Claude Code

Kai: it is literally just an SSM param. Removing the ceremony an agent built around it. ## What was there `auth header-token { value env FORGEJO_ADMIN_TOKEN }`. So a caller had to export the token first, which needed a helper to fetch it, which grew a TTY gate so headless callers could not pull it by accident. Each step was reasonable given the one before it. The first step was the mistake. ## What it is now The same `provider ssm` block the ordinary Forgejo wrapper has always used, pointed at `/forgejo/admin-token` and resolved at call time. ```kdl provider ssm { exec aws ssm get-parameter --with-decryption --output text --query "Parameter.Value" --name } auth header-token { header Authorization prefix "token " value ssm "/forgejo/admin-token" } ``` Access to the parameter is the boundary. That is where an SSM-backed credential's boundary belongs, and it is enforced by IAM rather than by whether stdin happens to be a terminal. ## Verified ``` $ echo "FORGEJO_ADMIN_TOKEN set? ${FORGEJO_ADMIN_TOKEN:-no}" FORGEJO_ADMIN_TOKEN set? no $ ward exec aosguard-run -- ops forgejo-admin org-label list coilyco-flight-deck org-label list via SSM-backed auth: OK, 11 labels ``` No env var, no TTY, no wrapper script. ## Follow-on, not in this PR `infrastructure/scripts/forgejo-admin-token.py` and its ~10 callers are the other half. They fetch the token to hand to raw `curl`, and several of them predate the guarded verbs entirely. Filed separately so this change can land on its own. ## Docs `docs/aosguard-forgejo-admin.md` gains a Credentials section and loses "attended" from its title, since the wrapper is no longer gated on a terminal. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 1 commit

2026-08-16 00:03:34 +00:00

fix(aosguard): read the admin PAT from SSM like every other credential

ci / ward-doctor (pull_request) Successful in 13s

Details

ci / aos-cli-tests (pull_request) Successful in 21s

Details

ci / gate (pull_request) Successful in 56s

Details

11c9e979a5

The admin wrapper took its token from FORGEJO_ADMIN_TOKEN, which meant a
caller had to export it first, which meant a helper script, which grew a TTY
gate to stop headless callers pulling it by accident.

None of that was load-bearing. It is an SSM parameter, and the ordinary
wrapper has always read its own token straight from SSM with `provider ssm`.
The admin wrapper now does the same against /forgejo/admin-token, resolved at
call time. Access to the parameter is the boundary, which is where an
SSM-backed credential's boundary belongs.

Verified: `aosguard ops forgejo-admin org-label list` returns with no
FORGEJO_ADMIN_TOKEN in the environment and no TTY.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-16 00:03:34 +00:00