mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
aef525f913
The persona contract expects every role to exercise the administrator and biber personas, and requires a persona-block-rationale where one cannot reach the application at all. 68 roles already carry it; these three did not. Each rationale names the mechanism, and each was checked against the declaration rather than taken at face value: - hermes admits only the administrator and mcp RBAC groups to its oauth2 proxy, so biber is refused at the proxy. allowed_groups lists exactly those two. - homeassistant runs its own auth provider with sso.enabled false, and its hub account comes from secrets.credentials.administrator_password rather than the platform user password. - the litellm admin UI has no platform-user concept, authenticating with the UI_USERNAME/UI_PASSWORD pair the service provisions, with sso.enabled false. Both sso pins verified as false in meta/services.yml. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
36 lines
1.7 KiB
Bash
36 lines
1.7 KiB
Bash
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
CSS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.css.enabled') | string | lower }}
|
|
|
|
HERMES_API_SERVER_KEY={{ lookup('config', application_id, 'secrets.credentials.api_server_key') | dotenv_quote }}
|
|
|
|
HERMES_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
KATA_SERVICE_ENABLED={{ lookup('config', application_id, 'services.kata.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
LITELLM_SERVICE_ENABLED={{ lookup('config', application_id, 'services.litellm.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate
|
|
MCP_SERVICE_ENABLED={{ lookup('config', application_id, 'mcp.enabled') | string | lower }}
|
|
|
|
OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}
|
|
|
|
# nocheck: persona-block-rationale: meta/services.yml admits only the web-app-hermes administrator and mcp RBAC groups to the oauth2 proxy (sso.oauth2.allowed_groups) and biber carries neither, so biber is refused at the proxy before the agent API is reached.
|
|
PERSONA_BIBER_BLOCKED=true
|
|
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|