wmantly
8f0158eb9f
See CHANGELOG.md for the full breakdown. Summary:
- ldap_tunnel.go: serves a local unix socket for SSSD/PAM and relays raw
bytes to the SSO over the existing WSS channel (ldap_tunnel messages);
the agent never parses LDAP (DESIGN.md §4). Adds safeWriter to
serialize WebSocket writes now that telemetry, heartbeat, the LDAP
tunnel, and command responses all share one connection.
- secrets.go: renders local templates ({{ bao "path#key" }} placeholders)
by fetching node-scoped values from the SSO and writing the target
atomically at 0600, on a signed render_secrets command (DESIGN.md §5).
demo/ has minimal bash + Node consumers of the rendered file.
- iam.go: applies signed node IAM pushes -- sudoers.d rules (visudo -c
validated), SSH AuthorizedKeysCommand keys, /etc/security/access.conf,
and revocation via sss_cache -E + pkill -u (DESIGN.md §6).
- Capability reporting: the agent's enabled capabilities ride along in
its discovery frame so the SSO can show them in the Directory.
- DESIGN.md: the v2 protocol design this implements.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
18 lines
605 B
JavaScript
18 lines
605 B
JavaScript
// Demo: a 3rd-party node app reads the secret the theta-agent rendered to disk.
|
|
const fs = require('fs');
|
|
const path = '/etc/theta/rendered/db.env';
|
|
console.log('=== node app reads the rendered secret ===');
|
|
if (fs.existsSync(path)) {
|
|
const env = fs.readFileSync(path, 'utf8');
|
|
const db = {};
|
|
for (const line of env.split('\n')) {
|
|
const m = /^(\w+)="(.*)"$/.exec(line.trim());
|
|
if (m) db[m[1]] = m[2];
|
|
}
|
|
console.log('DB_USER=' + db.DB_USER);
|
|
console.log('DB_PASS=' + db.DB_PASS);
|
|
} else {
|
|
console.error('rendered secret not found — run render_secrets first');
|
|
process.exit(1);
|
|
}
|