vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-ui: name the group the operator rule actually requires

Browse source 
Two comments said authelia's rule requires `group:operators`. The group
is `admins` (`operatorGroup` in swarm-authelia.nix), and the rule is now
an `operatorsOnly` pair.
This commit is contained in:
atlas 2026-10-14 21:47:15 +02:00 • committed by mara
commit 6f071f7963
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/swarm-ui.nix
View file

@ -127,7 +127,7 @@ in
# The swarm UI's own gateway surface. Published to agents on the # The swarm UI's own gateway surface. Published to agents on the
# bridge deliberately: reachability is not the access control here — # bridge deliberately: reachability is not the access control here —
# the `auth_request` below and authelia's `group:operators` rule # the `auth_request` below and authelia's `group:admins` rule
# are, and an agent that resolves the name still cannot open the # are, and an agent that resolves the name still cannot open the
# page. # page.
# #
@ -159,9 +159,9 @@ in
# #
# ⚠️ `auth_request` answers "is there a session", not "is this an # ⚠️ `auth_request` answers "is there a session", not "is this an
# operator". The operator-only part is authelia's `access_control` # operator". The operator-only part is authelia's `access_control`
# rule (./swarm-authelia.nix) requiring `group:operators` — agents # rules (`operatorsOnly` in ./swarm-authelia.nix): `group:admins`, then
# have authelia accounts of their own, and without that rule a # a `deny` for everyone else. Agents have authelia accounts of their
# session alone would open this page. # own, and without those rules a session alone would open this page.
# #
# ⚠️ Failure mode here is LOCKED OUT, not unprotected: a subrequest # ⚠️ Failure mode here is LOCKED OUT, not unprotected: a subrequest
# that wrongly denies takes the whole UI away. That is why the # that wrongly denies takes the whole UI away. That is why the