computer-playbook/roles/web-app-homeassistant/meta/users.yml at fix/dev-python/python-upper-bound - computer-playbook - Infinito.Nexus Code Hub

kevinveenbirkenbach/computer-playbook

0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5 28475455db feat(mcp): give every provider its own service account from the registry

Nine roles reached their MCP surface as the deployment administrator or with
an account password kept beside the account in credentials. A Moodle site
admin bypasses every capability check, a Nextcloud app password is not
scopable, a Gitea token reads every private repository, and a GitLab token on
root reads every private project. Each role now declares its own principal in
meta/users.yml and provisions it, so the exposed surface is what the service
role permits. jellyfin, zammad and snipe-it kept their account but took its
password from a credential named token; they read the registry too.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-12 15:44:12 +02:00

10 lines

274 B

YAML

Raw Permalink Blame History

 ---
 administrator:
   tokens:
     web-app-homeassistant: ""
 mcp-web-app-homeassistant:
   firstname: Infinito
   lastname: MCP
   accounts: []
   description: Account the Home Assistant long-lived MCP token is minted for; such a token carries the rights of whoever was logged in