sean/binjovi-plans
Watch
1
0
Fork
You've already forked binjovi-plans
 0
Code Issues Pull requests 1 Projects Releases 156 Packages Wiki Activity

feat(object-store): declare the outline bucket and identity #279

Merged
binjovi-bot merged 1 commit from feat/outline-object-store into trunk 2026-09-13 13:16:27 +00:00
Conversation 0 Commits 1 Files changed 1 +33
sean commented 2026-09-13 12:59:07 +00:00
Owner
Copy link

Declares the outline bucket and its identity, so Binjovi's object-store
converge creates them and proves the scoping.

Outline stores every attachment and avatar in S3. The identity holds s3:* over
outline and outline/* only — the same shape forgejo has — and is denied the
isolation canary, so each release of this catalog proves the key reaches its own
bucket and is refused another.

The seanfarm side ships beside this one (sean/seanfarm #705):

  • rustfs-identities/outline.yaml generates and freezes the key and opens a
    ClusterSecretStore that admits namespace outline only;
  • outline-argocd/credentials.yaml delivers it as Secret outline-s3-credentials
    under AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY.

Those are the names Outline's own storage driver reads (server/env.ts at
v1.10.1) and they are recorded in the secret block here so the two ends can be
checked against each other.

scripts/check passes, tests/object-store-test included: 19 identities, 10
buckets, 26 negative controls.

https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3

Declares the `outline` bucket and its identity, so Binjovi's object-store converge creates them and proves the scoping. Outline stores every attachment and avatar in S3. The identity holds `s3:*` over `outline` and `outline/*` only — the same shape `forgejo` has — and is denied the isolation canary, so each release of this catalog proves the key reaches its own bucket and is refused another. The seanfarm side ships beside this one (`sean/seanfarm` #705): - `rustfs-identities/outline.yaml` generates and freezes the key and opens a `ClusterSecretStore` that admits namespace `outline` only; - `outline-argocd/credentials.yaml` delivers it as Secret `outline-s3-credentials` under `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`. Those are the names Outline's own storage driver reads (`server/env.ts` at v1.10.1) and they are recorded in the `secret` block here so the two ends can be checked against each other. `scripts/check` passes, `tests/object-store-test` included: 19 identities, 10 buckets, 26 negative controls. https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3
feat(object-store): declare the outline bucket and identity
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
4fbcd4a7c3
 
Outline stores every attachment and avatar in S3. Give it a bucket of
its own and a key that reaches that bucket and nothing else.

The identity holds s3:* over `outline` and `outline/*` only, the same
shape forgejo has, and is denied the isolation canary so the converge
can prove the scoping on each release of this catalog.

The seanfarm side is already in place: rustfs-identities/outline.yaml
generates and freezes the key, and outline-argocd/credentials.yaml
delivers it into namespace outline under AWS_ACCESS_KEY_ID and
AWS_SECRET_ACCESS_KEY -- the names Outline's own storage driver reads,
recorded here so the two ends can be checked against each other.

Claude-Session: https://claude.ai/code/session_01JGe4pyhQ36AhgDfPJry4d3
binjovi-bot deleted branch feat/outline-object-store 2026-09-13 13:16:27 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/binjovi-plans!279
No description provided.