coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement NK-WP-0021 activity-core ops SSO least-privilege.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.
This commit is contained in:
tegwick 2026-07-22 15:47:26 +02:00
parent 3580e43e5f
commit a9aec541ec
8 changed files with 384 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

8
sso-mfa/k8s/lldap/create-secrets.sh
View file

@ -51,7 +51,7 @@ echo "Done. Secret lldap-secrets created in namespace: sso"
echo ""
echo "Next:"
echo " Apply manifests (see README.md apply order)."
echo " After LLDAP is Running, create application groups:"
echo " - Log in to https://lldap.coulomb.social with the admin account."
echo " - Create group: net-kingdom-users"
echo " - Create group: net-kingdom-admins"
echo " After LLDAP is Running, seed groups:"
echo " ./bootstrap-users.sh"
echo " Groups: net-kingdom-users, net-kingdom-admins, activity-core-operators"
echo " Membership runbook: OPERATOR-GROUPS.md"