4 Commits

Author	SHA1	Message	Date
wmantly	84d7c96c17	fix: LDAP enrollment uses localhost (not the public domain); align SSH access groups; roll up ldap-client v1.24.0 (v1.38.0) (#164) ... - setup.sh: ldap_host defaults to localhost (the public sso.<domain> can't reach the 389/636 LDAP ports through NAT); overridable via CFG_LDAPS_HOST - ldap.vars access groups + ldap-client sssd filter now reference the SSO group model (site_<loc>_hosts_access, site_<loc>_host_<host>_access, god_admin) - GROUPS.md §5/§8 updated to the corrected naming - gitlink: ldap-client ebaac18 (v1.24.0)	2026-08-04 23:30:04 -04:00
wmantly	72046a8b29	docs: group naming matches docs/GROUPS.md; roll up sso v1.27.0 (v1.37.0) (#163) ... - GROUPS.md: per-resource groups are {site}_{kind}_{name}_{level}; site carries god + site-wide only - gitlink: sso-manager-node e8d0420 (v1.27.0)	2026-08-04 23:02:14 -04:00
wmantly	a77aa8d2df	feat: seed god_admin + docker plugin, fix ldap-client enrollment, roll up sso v1.26.0 + theta-agent v1.3.0 (v1.36.0) (#161) ... - bootstrap: seed god_admin into the admin's groups; seed a docker-local discovery plugin - setup.sh: generate ldap-client/ldap.vars from the stack config so LDAP enrollment works - docs: GROUPS.md site-slug convention (verbatim, kind in resource slug) - gitlinks: sso-manager-node 8a9de94 (v1.26.0), theta-agent 52379c2 (v1.3.0)	2026-08-04 19:10:32 -04:00
wmantly	292b67c334	docs: group & permission model spec + link (v1.35.17) ... Add docs/GROUPS.md — the canonical Group & Permission Model (schema, inheritance resolver, Directory-only management, multi-site, host-side SSSD mapping, migration) — link it from the docs index, and note sso v1.25.0 in the changelog. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-04 15:04:30 -04:00