From 49b868fedb9335c8e8102af730274b227965316c Mon Sep 17 00:00:00 2001 From: William Mantly Date: Mon, 3 Aug 2026 23:05:04 -0400 Subject: [PATCH] fix: stop writing invalid service_control:true for theta-agent (v1.35.12) setup.sh's 'full control' edit set service_control: true, but that field is a []string allowlist, so theta-agent failed YAML decode and crash-looped. Remove the invalid edit; leave the operator's allowlist (or [] default = deny all). Co-Authored-By: Claude --- CHANGELOG.md | 5 +++++ setup.sh | 7 ++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 24955bc..239a9b2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,11 @@ orchestration code; see each submodule's own `CHANGELOG.md` [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md)) for what changed inside the apps it composes. +## [v1.35.12] - 2026-08-04 + +### Fixed +- **theta-agent crash-looped (`cannot unmarshal !!bool 'true' into []string`)** — setup.sh's "full control" edit wrote `service_control: true`, but that field is a `[]string` allowlist, so the agent failed to decode the config and restart-loop. Removed the invalid edit; `service_control` now stays as its allowlist (default `[]` = deny all) and the operator can list specific services. + ## [v1.35.11] - 2026-08-04 ### Fixed diff --git a/setup.sh b/setup.sh index a3dad68..2c57d90 100755 --- a/setup.sh +++ b/setup.sh @@ -1214,9 +1214,14 @@ if [[ "$CFG_THETA_AGENT_ENABLE" == "1" ]] && [[ -x /usr/local/bin/theta-agent ]] info " Configuring theta-agent with full host control capabilities..." if [[ -f /etc/theta42/agent.yml ]]; then sudo sed -i 's/arbitrary_bash: false/arbitrary_bash: true/' /etc/theta42/agent.yml - sudo sed -i 's/service_control: .*/service_control: true/' /etc/theta42/agent.yml + # service_control is a []string allowlist (NOT a bool) — setting it to + # `true` makes the agent fail YAML decode and crash-loop. There is no + # wildcard; leave the operator's list (or the [] default = deny all) + # alone and document how to enable specific services. + # sudo sed -i 's/service_control: .*/service_control: true/' ... sudo sed -i 's/reboot: false/reboot: true/' /etc/theta42/agent.yml sudo sed -i 's/configure_ldap: false/configure_ldap: true/' /etc/theta42/agent.yml + info " (service_control left as its allowlist; set e.g. service_control: [\"nginx\"] in /etc/theta42/agent.yml to permit managing specific services)" info " theta-agent full control enabled. Restarting service..." sudo systemctl restart theta-agent.service else