Rotate operator secrets into agenix and deepen caches

Scripts/bootstrap-forge-intake.sh

@@ -3,6 +3,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+# shellcheck source=Scripts/_burrow-secrets.sh
+source "${SCRIPT_DIR}/_burrow-secrets.sh"
 
 usage() {
   cat <<'EOF'
@@ -10,27 +12,33 @@ Usage: Scripts/bootstrap-forge-intake.sh [options]
 
 Copy the minimum Burrow forge bootstrap secrets onto the target host under
 /var/lib/burrow/intake with the ownership expected by the NixOS services.
+Legacy path only: the current forge runtime consumes agenix secrets directly.
 
 Options:
   --host <user@host>          SSH target (default: root@git.burrow.net)
   --ssh-key <path>            SSH private key used to reach the host
-                              (default: intake/agent_at_burrow_net_ed25519)
+                              (default: secrets/forgejo/agent-ssh-key.age, then intake/)
   --password-file <path>      Forgejo admin bootstrap password file
-                              (default: intake/forgejo_pass_contact_at_burrow_net.txt)
+                              (default: secrets/forgejo/admin-password.age, then intake/)
   --agent-key-file <path>     Agent SSH private key copied for runner bootstrap
-                              (default: intake/agent_at_burrow_net_ed25519)
+                              (default: secrets/forgejo/agent-ssh-key.age, then intake/)
   --no-verify                 Skip remote ls/stat verification after install
   -h, --help                  Show this help text
 EOF
 }
 
 HOST="${BURROW_FORGE_HOST:-root@git.burrow.net}"
-SSH_KEY="${BURROW_FORGE_SSH_KEY:-${REPO_ROOT}/intake/agent_at_burrow_net_ed25519}"
-PASSWORD_FILE="${BURROW_FORGE_PASSWORD_FILE:-${REPO_ROOT}/intake/forgejo_pass_contact_at_burrow_net.txt}"
-AGENT_KEY_FILE="${BURROW_FORGE_AGENT_KEY_FILE:-${REPO_ROOT}/intake/agent_at_burrow_net_ed25519}"
+SSH_KEY="${BURROW_FORGE_SSH_KEY:-}"
+PASSWORD_FILE="${BURROW_FORGE_PASSWORD_FILE:-}"
+AGENT_KEY_FILE="${BURROW_FORGE_AGENT_KEY_FILE:-}"
 KNOWN_HOSTS_FILE="${BURROW_FORGE_KNOWN_HOSTS_FILE:-${HOME}/.cache/burrow/forge-known_hosts}"
 VERIFY=1
 
+cleanup() {
+  burrow_cleanup_secret_tmpfiles
+}
+trap cleanup EXIT
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --host)
@@ -67,12 +75,29 @@ done
 
 mkdir -p "$(dirname "${KNOWN_HOSTS_FILE}")"
 
-for path in "${SSH_KEY}" "${PASSWORD_FILE}" "${AGENT_KEY_FILE}"; do
-  if [[ ! -s "${path}" ]]; then
-    echo "required file missing or empty: ${path}" >&2
-    exit 1
-  fi
-done
+SSH_KEY="$(
+  burrow_resolve_secret_file \
+    "${REPO_ROOT}" \
+    "${SSH_KEY}" \
+    "${REPO_ROOT}/intake/agent_at_burrow_net_ed25519" \
+    "${REPO_ROOT}/secrets/forgejo/agent-ssh-key.age" \
+    "${HOME}/.ssh/agent_at_burrow_net_ed25519"
+)"
+PASSWORD_FILE="$(
+  burrow_resolve_secret_file \
+    "${REPO_ROOT}" \
+    "${PASSWORD_FILE}" \
+    "${REPO_ROOT}/intake/forgejo_pass_contact_at_burrow_net.txt" \
+    "${REPO_ROOT}/secrets/forgejo/admin-password.age"
+)"
+AGENT_KEY_FILE="$(
+  burrow_resolve_secret_file \
+    "${REPO_ROOT}" \
+    "${AGENT_KEY_FILE}" \
+    "${REPO_ROOT}/intake/agent_at_burrow_net_ed25519" \
+    "${REPO_ROOT}/secrets/forgejo/agent-ssh-key.age" \
+    "${HOME}/.ssh/agent_at_burrow_net_ed25519"
+)"
 
 ssh_opts=(
   -i "${SSH_KEY}"