rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
326 Commits 3 Branches 0 Tags
ed644b2c832db19f7ee54fc112dbb8251cea5964
Commit Graph
7 Commits
Author SHA1 Message Date
rock ed644b2c83 feat: add S3 and SQS permissions to service accounts and capability groups 
- New capability groups: s3-users, s3-writers, sqs-users, sqs-writers
- portfolio-agent: add s3:read, sqs:read
- memory-agent: add s3:read, s3:write, sqs:read, sqs:write
- Enables portfolio and memory services to access MinIO S3 and message queues via JWT
 2026-09-05 00:14:43 -07:00
rock 8f7004c946 iam: switch service accounts to roles-based auth 
- Roles stored in user attributes, not groups
- Property mapping looks up roles by client_id for client_credentials
- Service account apps have no policy bindings (client_secret = access control)
- Cleanup stale bindings on re-provision
- JWT claims: azp (service identity) + roles (capabilities)
 2026-09-03 19:23:06 -07:00
rock f1e5fe58f4 iam: move provisioning script to scripts/iam, remove k8s job 
- Move authentik-provision.py to scripts/iam/ (manual-only)
- Remove job/RBAC resources (not needed for local runs)
- Use public URL directly (no sed substitution needed)
- Add app password support via set_key endpoint
- Support both password grant and client_credentials
 2026-09-03 19:03:58 -07:00
Story Crater Bot 27907387f6 docs: remove outdated docs describing the retired core/talos CLI workflow 2026-08-27 13:11:47 -07:00
Story Crater Bot d7c30a8af6 chore: retire TemporalWorker CRD — agent-harness-worker and Forgejo build workflow removed 2026-08-20 23:10:06 -07:00
Story Crater Bot e2781c72e2 chore(terraform): remove leftover terraform state-backup script and env example — repo is pure GitOps, terraform fully retired 2026-08-18 15:08:03 -07:00
Story Crater Bot 74729f1c59 docs(terraform): add state management script and best practices guide 2026-08-18 15:08:01 -07:00