coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add NK-WP-0021 for activity-core ops SSO least-privilege.

Browse source 
Promote NK-IN-0001/0002 after scope/intent review into a single ready
workplan (LLDAP operator group, membership runbook, Authelia domain rules,
live verification). Hub workstream and tasks registered via fix-consistency.
This commit is contained in:
tegwick 2026-07-22 15:21:22 +02:00
parent 101f91cbda
commit 3580e43e5f
3 changed files with 293 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/intakes/activity-core-ops-sso-operators.md
View file

@ -8,16 +8,12 @@ request least-privilege group gating on the public hosts.
Source design: `activity-core/docs/ops-sso-access.md`
Hosts: `activity.coulomb.social`, `temporal.coulomb.social`
Promote with (after route + owner review):
```bash
statehub promote-intake <state_hub_intake_id> \
--to workplan \
--repo-path ~/net-kingdom \
--repo-slug net-kingdom \
--domain communication
# or --to task --workplan-file workplans/<existing>.md
```
**Promotion (2026-07-22):** both intakes accepted after scope/intent review and
promoted into **`NK-WP-0021`**
(`workplans/NK-WP-0021-activity-core-ops-sso-operators.md`). Single workplan
because LLDAP group and Authelia domain rules share one deploy surface and a
hard dependency. See that workplan for refined tasks, non-goals, and the
verification matrix.
---
@ -28,13 +24,15 @@ id: NK-IN-0001
kind: intake
title: "Create LLDAP group activity-core-operators and membership runbook"
lane: blue
status: routed
status: closed
outcome: promoted
promoted_to: NK-WP-0021
priority: high
owner: net-kingdom
repo: net-kingdom
origin: "ACTIVITY-WP-0025-T06"
origin_ref: "activity-core/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md"
routed_note: "Implement in net-kingdom sso-mfa. Origin ACTIVITY-WP-0025-T06 (activity-core)."
routed_note: "Promoted 2026-07-22 into NK-WP-0021 (T01–T02). Implement in net-kingdom sso-mfa."
description: |
activity-core shipped Authelia SSO for the ops console and Temporal UI
(ACTIVITY-WP-0025). MVP accepts any authenticated Authelia user.
@ -54,6 +52,7 @@ description: |
notes: |
Related Authelia domain rules are NK-IN-0002 (depends on this group existing).
Requester residual task: ACTIVITY-WP-0025-T06 (status wait).
Promoted to NK-WP-0021 (combined workplan with NK-IN-0002).
state_hub_intake_id: "019f88ff-c5f1-7433-9d13-4ffe37dfef00"
```
@ -66,13 +65,15 @@ id: NK-IN-0002
kind: intake
title: "Authelia access_control for activity + temporal.coulomb.social"
lane: blue
status: routed
status: closed
outcome: promoted
promoted_to: NK-WP-0021
priority: high
owner: net-kingdom
repo: net-kingdom
origin: "ACTIVITY-WP-0025-T06"
origin_ref: "activity-core/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md"
routed_note: "Depends on NK-IN-0001 group. Implement in Authelia ConfigMap. Origin ACTIVITY-WP-0025-T06."
routed_note: "Promoted 2026-07-22 into NK-WP-0021 (T03–T04). Depends on NK-IN-0001 group."
description: |
Restrict browser access to activity-core public SSO hosts to members of
LLDAP group `activity-core-operators` (see NK-IN-0001).
@ -104,5 +105,6 @@ notes: |
Depends on NK-IN-0001 (group must exist). activity-core Ingress + middleware
already applied (k8s/railiance/30–32). No activity-core code change required
for group enforcement — headers already carry Remote-Groups.
Promoted to NK-WP-0021 (combined workplan with NK-IN-0001).
state_hub_intake_id: "019f88ff-cc9e-76b4-8ce3-eb354aabefe7"
```