Secret Management

A super important topic for any environment focusing on (semi-)automated deployments. The secret provider must allow a way to distribute secrets securely to CI jobs and individuals, so they can possibly access and use these for local troubleshooting and rescue purposes.

CodeFloe uses OpenBao, a fork of HashiCorp Vault managed by the Linux Foundation’s OpenSSF, as the source of truth for operational secrets. Access policies separate Forgejo, CI, database, Kubernetes, and shared infrastructure credentials.

Local infrastructure work uses direnv to authenticate to OpenBao and export only the variables required by the selected environment. The AppRole flow keeps this process non-interactive on CI and agent hosts, while interactive operator machines can use OIDC.

Crow CI keeps the repository secrets required by its isolated jobs. Sensitive values are limited to the required plugin images and trusted event types whenever possible.