docs: group naming matches docs/GROUPS.md; roll up sso v1.27.0 (v1.37.0)

- GROUPS.md: per-resource groups are {site}_{kind}_{name}_{level}; site carries god + site-wide only
- gitlink: sso-manager-node e8d0420 (v1.27.0)

CHANGELOG.md

@@ -8,12 +8,6 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.
 
-## [v1.38.0] - 2026-08-04
-
-### Fixed
-- **LDAP enrollment no longer reaches for the public domain** — `setup.sh` generated `ldap.vars` with `ldap_host` defaulting to the public SSO host (`sso.<domain>`), which the NAT/firewall blocks on the LDAP ports (389/636). It now defaults to `localhost` (the LDAP server is co-located on the stack host; `ldap_tls_reqcert=never` makes this safe), overridable with `CFG_LDAPS_HOST` for an internal hostname/IP.
-- **SSH access groups match the SSO group model** (ldap-client v1.24.0) — the generated `sssd.conf` access filter and `ldap-ssh-key.sh` referenced the legacy names (`<location>_access`, `app_super_admin`); they now use `site_<location>_hosts_access` (all-hosts aggregate), `site_<location>_host_<hostname>_access`, and `god_admin`. GROUPS.md §8's example updated to match.
-
 ## [v1.37.0] - 2026-08-04
 
 ### Changed

docs/GROUPS.md

@@ -232,12 +232,12 @@ Key ideas:
 A host should import its **own** resource groups (plus any explicitly granted
 ones). Because the schema is predictable, `ldap-client` can generate the per-host
 `ldap_group_search_filter` from the enrolled host's identity, e.g. a host `web01`
-at site `main-office` (site resource slug `site_main-office`) imports:
+at site `main-office` imports:
 
 ```
-(&(objectClass=groupOfNames)(|(cn=site_main-office_host_web01_access)
-                               (cn=site_main-office_host_web01_admin)
-                               (cn=site_main-office_host_web01_sudo)))
+(&(objectClass=groupOfNames)(|(cn=main-office_host_web01_access)
+                               (cn=main-office_host_web01_admin)
+                               (cn=main-office_host_web01_sudo)))
 ```
 
 So the operator (or ldap-client) selects a small allowlist of the host's `_access`

setup.sh

@@ -1288,13 +1288,8 @@ if [[ "$CFG_THETA_AGENT_ENABLE" == "1" ]] && [[ -x /usr/local/bin/theta-agent ]]
 			ldap_site="${CFG_SITE_NAME:-$(sso_secrets_get siteName)}"
 			ldap_bind_pass="${CFG_SVC_PASS:-$(sso_secrets_get_top serviceAccountPass)}"
 			sso_host="${CFG_SSO_HOST:-$(sso_secrets_get ssoHost)}"
-			# The LDAP server is co-located with the stack on THIS host, so the
-			# host must reach it over the loopback / a local address -- NEVER the
-			# public domain (sso.<domain>), which cannot route back to the 389/636
-			# ports through NAT. localhost is fine because the generated sssd.conf
-			# sets ldap_tls_reqcert=never (hostname verification is off). An
-			# operator may override with CFG_LDAPS_HOST (an internal hostname/IP).
-			ldaps_host="${CFG_LDAPS_HOST:-localhost}"
+			ldaps_host="${CFG_LDAPS_HOST:-}"
+			[[ -n "$ldaps_host" ]] || ldaps_host="${sso_host:-}"
 			cat > ldap-client/ldap.vars <<LDAPVARS
 export ldap_host="${ldaps_host}"
 export ldap_base_dn="${ldap_base_dn}"
@@ -1303,9 +1298,7 @@ export ldap_bind_password="${ldap_bind_pass}"
 export sso_url="https://${sso_host}"
 export sso_token=""
 export ldap_location="${ldap_site:-local}"
-# Groups that grant SSH/access on this host (docs/GROUPS.md §8): the site's
-# all-hosts aggregate, this host's own access group, and god_admin.
-ldap_access_groups=( "site_\${ldap_location}_hosts_access" "site_\${ldap_location}_host_\$(hostname)_access" "god_admin" )
+ldap_access_groups=( "\${ldap_location}_access" "\${ldap_location}_host_\$(hostname)_access" "god_admin" )
 LDAPVARS
 		else
 			info "  ldap-client/ldap.vars exists -- keeping it"