2026-07-22 10:47:25 +02:00
|
|
|
|
# Intakes — activity-core ops / Temporal UI SSO operators
|
|
|
|
|
|
|
|
|
|
|
|
Cross-repo handoff from **activity-core** `ACTIVITY-WP-0025` residual **T06**.
|
|
|
|
|
|
SSO edge is already live (Traefik ForwardAuth → Authelia); access is currently
|
|
|
|
|
|
any authenticated Authelia user (`default_policy: one_factor`). These intakes
|
|
|
|
|
|
request least-privilege group gating on the public hosts.
|
|
|
|
|
|
|
|
|
|
|
|
Source design: `activity-core/docs/ops-sso-access.md`
|
|
|
|
|
|
Hosts: `activity.coulomb.social`, `temporal.coulomb.social`
|
|
|
|
|
|
|
2026-07-22 15:21:22 +02:00
|
|
|
|
**Promotion (2026-07-22):** both intakes accepted after scope/intent review and
|
|
|
|
|
|
promoted into **`NK-WP-0021`**
|
|
|
|
|
|
(`workplans/NK-WP-0021-activity-core-ops-sso-operators.md`). Single workplan
|
|
|
|
|
|
because LLDAP group and Authelia domain rules share one deploy surface and a
|
|
|
|
|
|
hard dependency. See that workplan for refined tasks, non-goals, and the
|
|
|
|
|
|
verification matrix.
|
2026-07-22 10:47:25 +02:00
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## NK-IN-0001 — LLDAP group for activity-core operators
|
|
|
|
|
|
|
|
|
|
|
|
```yaml
|
|
|
|
|
|
id: NK-IN-0001
|
|
|
|
|
|
kind: intake
|
|
|
|
|
|
title: "Create LLDAP group activity-core-operators and membership runbook"
|
|
|
|
|
|
lane: blue
|
2026-07-22 15:21:22 +02:00
|
|
|
|
status: closed
|
|
|
|
|
|
outcome: promoted
|
|
|
|
|
|
promoted_to: NK-WP-0021
|
2026-07-22 10:47:25 +02:00
|
|
|
|
priority: high
|
|
|
|
|
|
owner: net-kingdom
|
|
|
|
|
|
repo: net-kingdom
|
|
|
|
|
|
origin: "ACTIVITY-WP-0025-T06"
|
|
|
|
|
|
origin_ref: "activity-core/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md"
|
2026-07-22 15:21:22 +02:00
|
|
|
|
routed_note: "Promoted 2026-07-22 into NK-WP-0021 (T01–T02). Implement in net-kingdom sso-mfa."
|
2026-07-22 10:47:25 +02:00
|
|
|
|
description: |
|
|
|
|
|
|
activity-core shipped Authelia SSO for the ops console and Temporal UI
|
|
|
|
|
|
(ACTIVITY-WP-0025). MVP accepts any authenticated Authelia user.
|
|
|
|
|
|
|
|
|
|
|
|
Needed in net-kingdom (LLDAP + ops docs), not in activity-core:
|
|
|
|
|
|
|
|
|
|
|
|
1. Create LLDAP group `activity-core-operators` (same style as
|
|
|
|
|
|
net-kingdom-users / net-kingdom-admins in sso-mfa/k8s/lldap/bootstrap-users.sh).
|
|
|
|
|
|
2. Document how to add/remove human operators (WebUI checklist and/or
|
|
|
|
|
|
script extension). Named founders/operators only — least privilege.
|
|
|
|
|
|
3. Do not invent OIDC clients in KeyCape for this path: activity-core uses
|
|
|
|
|
|
Traefik Middleware → Authelia `/api/verify` (ForwardAuth), not a new
|
|
|
|
|
|
oauth2-proxy/Keycloak client.
|
|
|
|
|
|
|
|
|
|
|
|
Acceptance: group exists in LLDAP; membership procedure written under
|
|
|
|
|
|
sso-mfa docs or CONFIG; at least one test operator can be assigned.
|
|
|
|
|
|
notes: |
|
|
|
|
|
|
Related Authelia domain rules are NK-IN-0002 (depends on this group existing).
|
|
|
|
|
|
Requester residual task: ACTIVITY-WP-0025-T06 (status wait).
|
2026-07-22 15:21:22 +02:00
|
|
|
|
Promoted to NK-WP-0021 (combined workplan with NK-IN-0002).
|
2026-07-22 10:47:25 +02:00
|
|
|
|
state_hub_intake_id: "019f88ff-c5f1-7433-9d13-4ffe37dfef00"
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## NK-IN-0002 — Authelia domain rules for activity / temporal hosts
|
|
|
|
|
|
|
|
|
|
|
|
```yaml
|
|
|
|
|
|
id: NK-IN-0002
|
|
|
|
|
|
kind: intake
|
|
|
|
|
|
title: "Authelia access_control for activity + temporal.coulomb.social"
|
|
|
|
|
|
lane: blue
|
2026-07-22 15:21:22 +02:00
|
|
|
|
status: closed
|
|
|
|
|
|
outcome: promoted
|
|
|
|
|
|
promoted_to: NK-WP-0021
|
2026-07-22 10:47:25 +02:00
|
|
|
|
priority: high
|
|
|
|
|
|
owner: net-kingdom
|
|
|
|
|
|
repo: net-kingdom
|
|
|
|
|
|
origin: "ACTIVITY-WP-0025-T06"
|
|
|
|
|
|
origin_ref: "activity-core/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md"
|
2026-07-22 15:21:22 +02:00
|
|
|
|
routed_note: "Promoted 2026-07-22 into NK-WP-0021 (T03–T04). Depends on NK-IN-0001 group."
|
2026-07-22 10:47:25 +02:00
|
|
|
|
description: |
|
|
|
|
|
|
Restrict browser access to activity-core public SSO hosts to members of
|
|
|
|
|
|
LLDAP group `activity-core-operators` (see NK-IN-0001).
|
|
|
|
|
|
|
|
|
|
|
|
Implementation target (live config):
|
|
|
|
|
|
- File: sso-mfa/k8s/authelia/configmap.yaml
|
|
|
|
|
|
- Today: access_control.default_policy: one_factor (no domain rules)
|
|
|
|
|
|
- Add domain rules for:
|
|
|
|
|
|
- activity.coulomb.social
|
|
|
|
|
|
- temporal.coulomb.social
|
|
|
|
|
|
requiring subject/group activity-core-operators (exact Authelia
|
|
|
|
|
|
subject syntax per current Authelia version — use fleet patterns if any
|
|
|
|
|
|
domain rules already exist for other apps).
|
|
|
|
|
|
|
|
|
|
|
|
Keep MFA posture consistent with fleet (KeyCape / privacyIDEA path; do
|
|
|
|
|
|
not set two_factor on Authelia itself unless that is the established
|
|
|
|
|
|
pattern for similar apps).
|
|
|
|
|
|
|
|
|
|
|
|
Rollout: apply Authelia ConfigMap + restart/reload Authelia in ns sso;
|
|
|
|
|
|
verify unauthenticated → login; authenticated non-member → deny/403;
|
|
|
|
|
|
member → pass-through to Traefik backends.
|
|
|
|
|
|
|
|
|
|
|
|
Acceptance:
|
|
|
|
|
|
- Unprivileged Authelia user cannot open ops UI or Temporal UI
|
|
|
|
|
|
- Member of activity-core-operators can open both hosts after login
|
|
|
|
|
|
- activity-core break-glass (ClusterIP port-forward + operator token)
|
|
|
|
|
|
remains documented and independent of Authelia groups
|
|
|
|
|
|
notes: |
|
|
|
|
|
|
Depends on NK-IN-0001 (group must exist). activity-core Ingress + middleware
|
|
|
|
|
|
already applied (k8s/railiance/30–32). No activity-core code change required
|
|
|
|
|
|
for group enforcement — headers already carry Remote-Groups.
|
2026-07-22 15:21:22 +02:00
|
|
|
|
Promoted to NK-WP-0021 (combined workplan with NK-IN-0001).
|
2026-07-22 10:47:25 +02:00
|
|
|
|
state_hub_intake_id: "019f88ff-cc9e-76b4-8ce3-eb354aabefe7"
|
|
|
|
|
|
```
|
