Bos55/nix-config
2
Fork 1
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity

feat(security): add truenas rbac automation script

Browse source
This commit is contained in:
Tibo De Peuter 2026-07-17 23:08:19 +02:00
parent 8fbecaa864
commit 67c7cb6ec6
Signed by: tdpeuter
SSH key fingerprint: SHA256:u/h/LVoqKF1Iz02uOyxe6hcjmoZASCGV2HM0TG9ZMoU
2 changed files with 103 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
BOOTSTRAP.md
View file

@ -67,5 +67,19 @@ Instead of relying on Forgejo CI/CD to store the staging private key, we use a s
```
3. This completely removes the secret from Forgejo. When Terraform spins up a staging VM, it simply tells Proxmox to attach this local snippet!
## 5. TrueNAS API Security (RBAC)
To prevent the CI/CD pipeline from having `root` access to your TrueNAS server, you must run the RBAC bootstrap script to create a restricted user (`forgejo-ci`) that can *only* clone datasets for staging, not destroy production data.
1. Ensure you have network access to your TrueNAS host.
2. Execute the RBAC setup script:
```bash
./scripts/truenas-rbac-setup.sh
```
3. Provide your TrueNAS IP and the `root` Admin API Token when prompted.
4. The script will automatically create the custom `ci-runner-role` and the `forgejo-ci` user.
5. Follow the terminal output instructions to log into the TrueNAS Web UI as the new user and generate the restricted API token.
6. Use this restricted token for the `TRUENAS_API_KEY` secret in Forgejo.
## Next Steps
Once these bootstrap steps are complete, the foundational authentication is in place. The Forgejo CI actions will now have the necessary permissions to build images, provision VMs, and test staging environments autonomously.
Once these bootstrap steps are complete, the foundational authentication is in place. The Forgejo CI actions will now have the necessary permissions to build images, provision VMs, and test staging environments autonomously and securely.