From e7a74f795df69d92e7da2157fb4974b71e5a88ee Mon Sep 17 00:00:00 2001
From: root <root@hubris.local>
Date: Wed, 20 May 2026 21:14:03 +0200
Subject: [PATCH] bootstrap.sh: auto-call refresh-creds when the client is a
 PAT recipient

End of enrollment, if secrets/gitea-pat.yaml is decryptable with the
just-issued age key (i.e. the operator has already run --finalize-pubkey
from another client), upgrade /etc/homelab-context/git-credentials from
the read-only bootstrap PAT to the write-scoped one. Best-effort: fails
silently if not yet a recipient, with a clear hint about what to do next.

Removes the post-bootstrap manual 'homelab refresh-creds' step from the
common flow; falls back to the documented one-liner for first-bootstrap
clients.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 bootstrap.sh | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/bootstrap.sh b/bootstrap.sh
index dd6cb0d..4b3e18d 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -264,6 +264,26 @@ esac
 run "ln -sfn '$CLONE_DIR/AGENTS.md' '$AGENTS_LINK'"
 echo "[bootstrap] linked AGENTS.md → $AGENTS_LINK"
 
+# -------- auto-upgrade to write-scoped Gitea PAT --------
+# After enrollment, if this client is already a recipient on
+# secrets/gitea-pat.yaml (i.e. the operator has run
+# `homelab client add --finalize-pubkey` from another client), swap the
+# read-only bootstrap PAT for the write-scoped one. Best-effort: fails
+# silently if the client isn't yet a recipient — the operator just re-runs
+# bootstrap or `homelab refresh-creds` later.
+if [ "$NO_SECRETS" -eq 0 ] && [ "$DRY_RUN" -eq 0 ] \
+   && command -v sops >/dev/null 2>&1 \
+   && [ -f "$CLONE_DIR/secrets/gitea-pat.yaml" ]; then
+    if /usr/local/bin/homelab refresh-creds >/tmp/homelab-refresh-creds.log 2>&1; then
+        echo "[bootstrap] refresh-creds: write-scoped Gitea PAT installed"
+    else
+        echo "[bootstrap] refresh-creds: skipped (this client isn't yet a recipient"
+        echo "            on secrets/gitea-pat.yaml — run 'homelab client add"
+        echo "            $HNAME --finalize-pubkey <age...>' from an existing client,"
+        echo "            then re-run bootstrap or 'homelab refresh-creds')"
+    fi
+fi
+
 # -------- MCP wiring --------
 if [ "$WITH_MCP" -eq 1 ]; then
     # Pick the right user's home — when invoked via sudo, SUDO_USER is set.