coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish ACTIVITY-WP-0025 after NK-WP-0021 group allowlist.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Close T06: LLDAP activity-core-operators and Authelia domain rules are live
in net-kingdom. Mark the workplan finished, update G10/runbook/SSO design
with membership pointers, and clear residual handoff notes.
This commit is contained in:
tegwick 2026-07-22 17:47:57 +02:00
parent 6134b82101
commit fee89c4ea1
6 changed files with 49 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/ops-sso-access.md
View file

@ -47,16 +47,18 @@ Response headers trusted into the app:
### Access control policy
Authelia global `default_policy: one_factor` currently applies. MVP accepts any
authenticated Authelia user. Follow-up (T06) is filed as work-record intakes
in **net-kingdom** (not hub-only notes):
Authelia `default_policy: one_factor` for the fleet; **restricted hosts** use
domain rules (NK-WP-0021, finished):
| Intake | Scope |
| Host | Rule |
| --- | --- |
| `NK-IN-0001` | LLDAP group `activity-core-operators` + membership runbook |
| `NK-IN-0002` | Authelia domain rules for `activity` + `temporal` hosts |
| `activity.coulomb.social` | allow `group:activity-core-operators`, else deny |
| `temporal.coulomb.social` | allow `group:activity-core-operators`, else deny |
See `net-kingdom/docs/intakes/activity-core-ops-sso-operators.md`.
Membership: `net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md`
(`./manage-group-members.sh add <uid> activity-core-operators`).
Intakes NK-IN-0001/0002 closed → promoted to **NK-WP-0021**.
## Mutation identity

11
docs/runbook.md
View file

@ -120,6 +120,17 @@ the UI** — change definition files and sync.
Login via Authelia (`auth.coulomb.social`). Design: `docs/ops-sso-access.md`.
Mutations use SSO identity; shared token is break-glass only.
**Who may log in:** LLDAP group `activity-core-operators` (Authelia domain
rules — net-kingdom NK-WP-0021). Add/remove members:
```bash
# from net-kingdom checkout
cd sso-mfa/k8s/lldap
./manage-group-members.sh add <uid> activity-core-operators
./manage-group-members.sh list activity-core-operators
# full runbook: OPERATOR-GROUPS.md
```
**DNS (already set for TLS):**
```text