wmantly
e613874de5
Second milestone of the Windows parity work (DESIGN-WINDOWS.md §13). WireGuard mesh client (signed, WSS-delivered): - wireguard_apply / wireguard_remove commands: Ed25519-verified, gated on a new wireguard capability. Linux applies via wg-quick up/down; Windows installs the peer config as a WireGuardTunnel service via wireguard.exe (/installtunnelservice, /uninstalltunnelservice) - state polling in the home monitor drives the blue tray icon and auto-VPN: connect when away from home + auto_vpn, disconnect on return (2m cooldown) - tray VPN toggle and the auto-VPN checkbox are now live; the preference persists to agent.yml (PersistAutoVPN) IAM on Windows (iam_windows.go): - allowed_login_groups -> net localgroup; ssh_keys -> per-profile authorized_keys + %ProgramData%\ssh\administrators_authorized_keys; revoke_users -> helper logs off all of the user's WTS sessions; sudo_rules logged as no direct equivalent Tray enrichment: - Open Config (opens agent.yml), Clear enrollment (re-enroll) menu items - set_auto_vpn persists; vpn_connect/vpn_disconnect/reinit/open_config commands handled by the daemon (tray_server.go) Packaging & release: - installer/windows/installer.iss: fully-offline Inno Setup bundle (agent, tray, helper, vendor-signed WireGuard MSI, OpenCredential CP, VC++ redist), /SILENT /SERVER_URL /JOIN_KEY parameters, SYSTEM service + HKLM Run tray autostart, Users-writable %ProgramData%\Theta42 for the IPC socket - .github/workflows/build-windows.yml: build + test, pinned vendor downloads, ISCC compile, Azure Trusted Signing (OIDC), SHA256SUMS, GH release attach, optional SSO resource publish - agent.yml.example documents auto_vpn, wireguard, service_name, desktop_helper, public_ip_detect Tests: - wireguard_apply/remove dispatch (allowed + capability-denied), PersistAutoVPN, ClearEnrollment; dispatch tests pin linuxPlatformOps with a temp WireGuard conf - end-to-end verified against a local mock SSO on Windows: join-key enrollment (token persisted, join key blanked), discovery/telemetry pushed, signed arbitrary_bash verified + executed via powershell -EncodedCommand; tray IPC socket binds %ProgramData%\Theta42; LDAP byte-pump binds 127.0.0.1:389; helper update swap verified Rebuilds all tracked dist binaries (v2.1.0).
99 lines
4.1 KiB
Plaintext
99 lines
4.1 KiB
Plaintext
# theta-agent configuration file
|
|
# Default location: /etc/theta42/agent.yml (Linux) or %ProgramData%\Theta42\agent.yml (Windows)
|
|
|
|
server_url: "https://sso.example.com"
|
|
|
|
# This agent's own token. Leave EMPTY when installing with a join key -- the
|
|
# agent fills it in itself once the SSO enrolls it. The server records only a
|
|
# hash and rejects any token it did not issue, so a locally invented value will
|
|
# never connect.
|
|
auth_token: ""
|
|
|
|
# The one credential you need to add a host. Used only while auth_token is
|
|
# empty: the SSO exchanges it for this agent's own token + public key on first
|
|
# connect, and the agent then blanks this line. Get one from the SSO
|
|
# (Directory -> Install Agent, or POST /api/agent/join-keys).
|
|
join_key: ""
|
|
|
|
# Base64 of the SSO's RAW 32-byte Ed25519 public key (NOT a PEM body). Filled in
|
|
# automatically when enrolling with a join key; set it by hand only if you
|
|
# pre-registered this host.
|
|
#
|
|
# Required for any high-risk command. Without it the agent still reports
|
|
# telemetry, but REFUSES reboot / service_restart / configure_ldap /
|
|
# arbitrary_bash / update_binary, because it has no way to verify them.
|
|
public_key: ""
|
|
|
|
location: "default" # Location identifier (e.g., site, datacenter) for naming
|
|
|
|
# Local LDAP byte-pump socket (DESIGN.md §4). The agent forwards raw LDAP bytes
|
|
# from this socket to the SSO, which relays them into its OpenLDAP. The agent
|
|
# never parses LDAP. Point SSSD at it with:
|
|
# ldap_uri = ldapi://%2frun%2ftheta%2fldap.sock
|
|
# (Windows relies on the TCP loopback listener 127.0.0.1:389 instead.)
|
|
ldap_socket: "/run/theta/ldap.sock"
|
|
|
|
# Auto-connect the WireGuard tunnel when this host is away from home and the
|
|
# directory WebSocket is up. The tray checkbox persists here too.
|
|
auto_vpn: false
|
|
|
|
# Windows-specific (DESIGN-WINDOWS.md §11). Ignored on Linux.
|
|
service_name: "theta-agent" # Windows service name
|
|
desktop_helper: "" # theta-agent-helper.exe path (session-0 ops)
|
|
public_ip_detect: true # false = air-gap: never call external IP services
|
|
|
|
# WireGuard mesh client (DESIGN-WINDOWS.md §5). The signed wireguard_apply
|
|
# command pushes the peer config down the WSS channel; these are local paths.
|
|
wireguard:
|
|
tunnel_name: "theta-mesh"
|
|
conf: "" # "" = platform default (/etc/wireguard/... or %ProgramData%\Theta42\wg\...)
|
|
executable: "" # wireguard.exe path (Windows; "" = PATH/default install)
|
|
|
|
capabilities:
|
|
# ---------------------------------------------------------
|
|
# Basic Capabilities (Safe, read-only or infrastructure management)
|
|
# ---------------------------------------------------------
|
|
|
|
# Push CPU, RAM, GPU, and ZFS metrics to the SSO Manager
|
|
telemetry: true
|
|
|
|
# Allow the SSO Manager to push down SSSD and SSH keys configuration
|
|
configure_ldap: true
|
|
|
|
# Serve the local LDAP byte-pump socket for SSSD/PAM (DESIGN.md §4)
|
|
ldap_tunnel: true
|
|
|
|
# Render OpenBao secrets to local files from /etc/theta/templates (DESIGN.md §5)
|
|
secrets: true
|
|
|
|
# Apply node IAM (sudo rules, SSH keys, access control, revocation) (DESIGN.md §6)
|
|
iam: true
|
|
|
|
# Accept signed wireguard_apply/wireguard_remove commands (DESIGN-WINDOWS.md §5)
|
|
wireguard: false
|
|
|
|
# Secret templates to render (DESIGN.md §5). Each maps a local template to a
|
|
# target file and an optional post-render reload. The template embeds secrets as
|
|
# {{ bao "secret/data/nodes/<node-id>/<name>#<key>" }}.
|
|
# secrets:
|
|
# - template: /etc/theta/templates/db.env.tpl
|
|
# target: /etc/theta/db.env
|
|
# reload: systemctl reload app
|
|
|
|
# ---------------------------------------------------------
|
|
# Advanced Capabilities (High risk, remote operations)
|
|
# ---------------------------------------------------------
|
|
|
|
# Allow remote system reboots via the SSO Manager
|
|
reboot: false
|
|
|
|
# Allow restarting, starting, or stopping specific systemd services.
|
|
# Must be an explicit list of allowed service names.
|
|
# Example: ["gitea", "nginx", "docker"]
|
|
# Setting to true or [] denies all.
|
|
service_control: []
|
|
|
|
# CRITICAL: Allow the execution of raw bash scripts sent from the SSO Manager.
|
|
# Useful for GitOps deployments, but allows remote code execution.
|
|
arbitrary_bash: false
|