mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 05:14:29 +00:00
7b391ab5ed
Problem: 'defaults write' is not an onboarding path, it's a support
incident waiting to happen. Browser SPNEGO must be deployed via managed
policy at machine provisioning time, not per-user.
Changes:
etc/init_knoe_users.sh
- _op_ensure_auth(): tries OP_SERVICE_ACCOUNT_TOKEN env, k8s secret
'op-service-account-token', existing interactive session, and op-run
inheritance — in that order. Gives actionable instructions when none
work, including the correct 'op run --' invocation documented in k3s.cfg.
- gitea_ensure_password(): calls _op_ensure_auth() at entry; eliminates
the silent 'op not authenticated' failure path.
- Script header: documents 'op run -- bash etc/init_knoe_users.sh' as
the intended invocation for admin's laptop.
- 'Next steps' output: replaces 'defaults write' with reference to
workstation_kerberos.yml Ansible playbook.
infrastructure/playbooks/workstation_kerberos.yml (new)
- Deploys /etc/krb5.conf (PROLE.ORG realm, myrddin KDC) to all managed
endpoints.
- Deploys Chrome + Edge managed policy (AuthServerAllowlist) on macOS
and Linux — no per-user browser configuration ever required.
- Idempotent; run during laptop provisioning or re-run at any time.
- Targets 'workstations' Ansible group.
infrastructure/inventory/hosts.ini
- Adds [workstations] group with example entries and onboarding notes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| acme.yml | ||
| audit.yml | ||
| bootstrap_local_ansible_user.yml | ||
| certmgr.yml | ||
| cgroups.yml | ||
| check_k3s_endpoint.yml | ||
| disable_pi_k3s.yml | ||
| iscsi_cleanup.yml | ||
| iscsi_login.yml | ||
| iscsi_mount.yml | ||
| k3s_cleanup.yml | ||
| k3s_delete.yml | ||
| k3s_diagnose_repair.yml | ||
| k3s_fetch_kubeconfig.yml | ||
| k3s_import_images.yml | ||
| k3s_install_single.yml | ||
| k3s_mariadb_datastore_prepare.yml | ||
| k3s_mariadb_datastore_rollout.yml | ||
| k3s_reset.yml | ||
| k3s_server_refresh.yml | ||
| k3s_start_single.yml | ||
| k3s_stop.yml | ||
| k3s_sync.yml | ||
| kerberos_trust_setup.yml | ||
| merlin_mariadb_full_export.yml | ||
| merlin_mariadb_full_import.yml | ||
| merlin_mariadb_provision.yml | ||
| prole_logs_migrate.yml | ||
| rotate_pihole_db.yml | ||
| site.yml | ||
| smoke_ping.yml | ||
| start_k3s_agents.yml | ||
| start_k3s_servers.yml | ||
| stop_k3s_agents.yml | ||
| stop_k3s_servers.yml | ||
| swap.yml | ||
| sync_pihole_toml.yml | ||
| tailscale.yml | ||
| test_k3s_kubeconfig_rewrite.yml | ||
| test_k3s_validate_args.yml | ||
| tmp_bao_dir.yml | ||
| tmp_mount.yml | ||
| workstation_kerberos.yml | ||