Merge pull request #155 from theta42/fix/theta-agent-service-control-v1.35.12

fix: stop writing invalid service_control:true for theta-agent (v1.35.12)

CHANGELOG.md

@@ -8,6 +8,11 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.
 
+## [v1.35.12] - 2026-08-04
+
+### Fixed
+- **theta-agent crash-looped (`cannot unmarshal !!bool 'true' into []string`)** — setup.sh's "full control" edit wrote `service_control: true`, but that field is a `[]string` allowlist, so the agent failed to decode the config and restart-loop. Removed the invalid edit; `service_control` now stays as its allowlist (default `[]` = deny all) and the operator can list specific services.
+
 ## [v1.35.11] - 2026-08-04
 
 ### Fixed

setup.sh

@@ -1214,9 +1214,14 @@ if [[ "$CFG_THETA_AGENT_ENABLE" == "1" ]] && [[ -x /usr/local/bin/theta-agent ]]
 		info "  Configuring theta-agent with full host control capabilities..."
 		if [[ -f /etc/theta42/agent.yml ]]; then
 			sudo sed -i 's/arbitrary_bash: false/arbitrary_bash: true/' /etc/theta42/agent.yml
-			sudo sed -i 's/service_control: .*/service_control: true/' /etc/theta42/agent.yml
+			# service_control is a []string allowlist (NOT a bool) — setting it to
+			# `true` makes the agent fail YAML decode and crash-loop. There is no
+			# wildcard; leave the operator's list (or the [] default = deny all)
+			# alone and document how to enable specific services.
+			# sudo sed -i 's/service_control: .*/service_control: true/' ...
 			sudo sed -i 's/reboot: false/reboot: true/' /etc/theta42/agent.yml
 			sudo sed -i 's/configure_ldap: false/configure_ldap: true/' /etc/theta42/agent.yml
+			info "    (service_control left as its allowlist; set e.g. service_control: [\"nginx\"] in /etc/theta42/agent.yml to permit managing specific services)"
 			info "  theta-agent full control enabled. Restarting service..."
 			sudo systemctl restart theta-agent.service
 		else