darmanandClaude Opus 5
503623551a
The previous token was write:repository only, which clones, fetches and pushes branches perfectly well and then fails at `tea pr create` — a pull request is an issue in gitea's data model, so every /pulls endpoint gates on the issue scope category rather than the repository one. Regenerated with write:repository,write:issue,read:user. Confirmed against the running instance: gitea reports the granted set as read:activitypub, read:misc, read:notification, read:organization, read:package, write:issue, write:repository, read:user so write:issue is present rather than only read:issue, which would satisfy the GET half and still fail the POST that opens the PR. The extra read:* categories are gitea expanding the request, not something asked for. No manual step on mars: gitea_luna_token already restarts hermes-agent-prepare-dirs, which does delete-then-add for the tea login on every start and so picks up the rotation by itself. The old token is NOT revoked — gitea's CLI cannot delete tokens and the API route needs basic auth as luna, which nothing here sets. It stays valid until removed by hand. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa
33 lines
3.3 KiB
YAML
33 lines
3.3 KiB
YAML
darman_password: ENC[AES256_GCM,data:3Kj3wfGDfS2vvTCaYC87Aq8ak2DDWqDP0YjxXk8V1CMkA2wnAP41aw++/soU0gpyMGDOY759WqRu0Wzup0Gbg4ywzQKoxbuz8Oi7mV/FxxraYsBlej0R4t+1484msrboUV4hdVdn4XdPuA==,iv:jqFcanbGXFgPNnFaZ/+TzfoUPZOJTNFcyZIGCKqC5is=,tag:bwbYiNwL79h5R30feyxpBw==,type:str]
|
|
samba_password: ENC[AES256_GCM,data:4eBsiIGLdImuf7fdCItb8GIfR5A=,iv:+ryMF+7kJrDKw7qLWpP6asZzu85pFFJuOan1NMwIbr4=,tag:s8XslqPR0ptdVaOWDWRiyQ==,type:str]
|
|
tailscale_authkey: ENC[AES256_GCM,data:An+OPDZF9kmemzoDhZPo7yMljksCz3yE/W9I1EAwtjXH3Iwe/L93Vr+WsWmw/mbvJFXMi2Vk20JIm6D/lm0zJe0qsd7Ooaj26h3xiAfG0PtoxUt+ABFXkQ==,iv:ShgYTnTb1VLOMYPJHjfs+LSebMI2fkKxU7wFzzFtiTo=,tag:9eSYCNKllY/xkhC1gC7hRw==,type:str]
|
|
opencode_go_api_key: ENC[AES256_GCM,data:x7V6iRrP6UMvMAYh/25bcrE10MHhL9lasCYRHiQ3PIDI6aL+uXP0/YpfrRPY+60m5Yv+Bd7+9aWTWdAVu1laSNjJGg==,iv:EmEAig+fSMYX+g77UpkiQ0USxUYOfFWX4WjIj9NA9N8=,tag:Pr+EZW6uDTSGjng8iG2SZw==,type:str]
|
|
telegram_bot_token: ENC[AES256_GCM,data:WX+KFtoqFodkoWNwd7EXUrUJakZ9oaMZgg4OnCeL/JVXcsdQesD1PLmKp6vK9g==,iv:m1oqKlcesvhMLtndyp/XxsUAy0YpEsSulPDK0V+Wh0A=,tag:zvLcxcQ+A4fQUht5GkL2Qw==,type:str]
|
|
hermes_dashboard_oidc_client_secret: ENC[AES256_GCM,data:IMPNTPMKO+b7eyV4hyGfnvH1/i+W4IPDNjncoyB1oIV8WaB6nOJn0sSEuTUCKB94K+Y7bsVQU0zpbKdIYOdGqgmPzwMCsScxMt4SewTmiiqWxv6SQFf4EzMxgXqjMvH8PWDzLcI2C2tI/KcVS251iqRViOTFe1/tkm+mV8sJmEI=,iv:F/rOUDmJZoGPS9fObAni5ntyOqbbhMWDPdHGLTexwlA=,tag:ALf98DmB0JziGspZMiLCiw==,type:str]
|
|
gitea_luna_token: ENC[AES256_GCM,data:0ypW9oVFs1mXYPhPareMFRdkSYcvHSCm+fQOd7/76lJEXi217r9dmg==,iv:j3TPm/iLk6pB6CmDePFBOlnhxWSbmLKvOhz06SM1T7k=,tag:ydErvC2mZ1RRnwNffiHkkg==,type:str]
|
|
gitea_hermes_webhook_secret: ENC[AES256_GCM,data:lV78H0xAehPxusSO/QruOYkt7fkMJrW+ScZL4UWYvgnBGn/D+1XHYPyHCqe2sEEWSlIaAgWMMoZzoVJ1Z1NFVQ==,iv:GmTZxoH2iiL/vTVgPfziXIFYD+Rl3cbh9hqXvWps+iw=,tag:jtXEUOVFfKrpTRK7S9PZMA==,type:str]
|
|
sops:
|
|
age:
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5NkwwZlB3bEptRmhlUS9u
|
|
NCtma3lERDAwdDNuTlF4clhTbVlBb1pFMENJCkxuUVp4SkdCTmZQNm5lYjNzZnlq
|
|
RWZEcGVtNWM3b1R3SkZaWXI3NjVSNG8KLS0tIDRmUjcwa2hjeEFTNEl3QndQbzlp
|
|
V0dFRWJjSldOcTVoNHVGbkgwMmRTdTgKdhINgxsZ5Y8qRF1yDQUOQAwfi8NTEFvw
|
|
/+WJUFY4fuDW/2o9Cq+UMNT6YXEQQ3kyRmz/Qb/+rD8XwlM9mLGg6A==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTmR3T0c1RjFvR3FOQUJK
|
|
SUxwcENlQUxRTndKdURnV0p5L3A1Sk1odHcwCmx4VFc5ZWdrZ3JNc3JkMmQ1M3li
|
|
WG5ZWG9uZmliKzYzam5oMjhFV0lOTkUKLS0tIGc1MkNSVE50NTl3STBZdlIrZCsx
|
|
TGR0RmVubmYwVExKV0QvamJnYWgrWkkKAZuwoC4Q4JXKv3tNo5MaKKooUgkwZvs4
|
|
oyJ7PS3lW+PxH5AZkeeU7gXO/pz2oDku0aDOds7kaD3n0+qSWicQ+Q==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1eapjg6tdrr0fuvmgs3q3nlvnjkaxez298qynqqqxt0lpcv0lrsyq7ayxjk
|
|
lastmodified: "2026-08-23T05:55:49Z"
|
|
mac: ENC[AES256_GCM,data:a3vCmrQMCS25tNWrzTeiGmOHf4Fn356PO3uNa2HvS21EBCKTc6YWBj9KmpORdz+6t03JJe/4eiGdghGaLhRr+JXyQnaT54gSV+FhC3dH6blind746XN3h+Z9rxiva6apvcAGUZ9k01Js5IXN9efEMhcI6w0U4oVuVqtvShvg8A8=,iv:9kF3cJ1vyy2H3eH10DVCYmWeXv2MH4AFDiF8cOajlw4=,tag:zhombLVpL8M1TUtYur/gYQ==,type:str]
|
|
unencrypted_suffix: _unencrypted
|
|
version: 3.13.3
|