From 6f071f7963852a2b4890c6a398a5c74997332ae8 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 14 Oct 2026 21:47:15 +0200 Subject: [PATCH] swarm-ui: name the group the operator rule actually requires Two comments said authelia's rule requires `group:operators`. The group is `admins` (`operatorGroup` in swarm-authelia.nix), and the rule is now an `operatorsOnly` pair. --- nix/host-modules/swarm-ui.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nix/host-modules/swarm-ui.nix b/nix/host-modules/swarm-ui.nix index 998286f7..3478c1b8 100644 --- a/nix/host-modules/swarm-ui.nix +++ b/nix/host-modules/swarm-ui.nix @@ -127,7 +127,7 @@ in # The swarm UI's own gateway surface. Published to agents on the # bridge deliberately: reachability is not the access control here — - # the `auth_request` below and authelia's `group:operators` rule + # the `auth_request` below and authelia's `group:admins` rule # are, and an agent that resolves the name still cannot open the # page. # @@ -159,9 +159,9 @@ in # # ⚠️ `auth_request` answers "is there a session", not "is this an # operator". The operator-only part is authelia's `access_control` - # rule (./swarm-authelia.nix) requiring `group:operators` — agents - # have authelia accounts of their own, and without that rule a - # session alone would open this page. + # rules (`operatorsOnly` in ./swarm-authelia.nix): `group:admins`, then + # a `deny` for everyone else. Agents have authelia accounts of their + # own, and without those rules a session alone would open this page. # # ⚠️ Failure mode here is LOCKED OUT, not unprotected: a subrequest # that wrongly denies takes the whole UI away. That is why the