From c570da0932e9e83409bb00d30e601ef39e1e39cd Mon Sep 17 00:00:00 2001 From: iris Date: Sat, 15 Aug 2026 11:54:37 +0200 Subject: [PATCH] docs(turn-loop): dedupe matrix.url rationale, trim historical framing --- docs/turn-loop/config.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/docs/turn-loop/config.md b/docs/turn-loop/config.md index e02c5a45..0f81c8ef 100644 --- a/docs/turn-loop/config.md +++ b/docs/turn-loop/config.md @@ -50,8 +50,8 @@ hyperhive.user.passwordlessSudo = true; # default Grants the per-agent unix user passwordless `sudo` (`NOPASSWD: ALL`). Enabled by default so claude's shell tools work for operations that need root inside the container (`systemctl`, package managers in dev -shells, etc.) — the same privilege surface the previous root-user shape -had, now elevated explicitly rather than implicitly. +shells, etc.) — the agent user gets root explicitly via `sudo` rather +than running as root itself. Set to `false` for agents that should be strictly unprivileged. Any tool invocation that needs root then fails loudly with the standard @@ -162,13 +162,12 @@ Override per-agent when an agent should talk to a different homeserver — for example a remote hive's tuwunel reached over a VPN, or an external Matrix server for a federation-only agent. -**Defaults to `null`, meaning "no matrix" — for the same reason -`forge.url` does.** The homeserver may live on another host, and a -loopback default resolves inside the agent's own netns to the agent, -so it would be a value that evaluates fine and then talks to the wrong -machine. With `null` the daemon has no homeserver and no-ops exactly as -it does without a token. The hive only forwards `HIVE_MATRIX_URL` when -it actually has a matrix vhost to name, so `null` survives where a hive +**Defaults to `null`, meaning "no matrix" — same reasoning as +`forge.url` above** (a loopback default would resolve inside the +agent's own netns to the agent itself, not the homeserver). With +`null` the daemon has no homeserver and no-ops exactly as it does +without a token. The hive only forwards `HIVE_MATRIX_URL` when it +actually has a matrix vhost to name, so `null` survives where a hive runs no homeserver, or where the agent modules are evaluated outside a hive.