vh
7ca2f76d21
Prime ruled albok subsumes note intake (1530). The wing is like personal/notes (albok-personal 1511, not service-restricted); health reads 7 wings ready. Nemi's token was re-minted with read+write on the new wing and vaulted over albok/token-nemi. /srv/nemi/inbox is lkraven:nemi-drop 2770 with a default ACL, plus u:lkraven:rx on /srv/nemi, so Nemi reaches it from lkraven's user manager, whose groups predate nemi-drop. Both paths are verified by the playbook.
39 lines
2.2 KiB
YAML
39 lines
2.2 KiB
YAML
# nh3-dev: /srv/nemi/inbox, the capture root Nemi walks into albok's personal/inbox wing (unit 4.4 slice C; albok-dev
|
|
# 2026-10-13 after Prime's 1530 intake ruling). People and agents drop markdown here; Nemi ingests each file once
|
|
# (capture mode never tombstones on absence, so a walked file may be moved away).
|
|
# scripts/elway infra-ops@10.100.10.50 --playbook playbooks/nh3-dev-nemi-inbox.yaml
|
|
# Writers: group nemi-drop (lkraven, infra-ops). Nemi runs as lkraven from the user manager, whose groups were fixed
|
|
# at its start, so lkraven's access does not depend on the new group: the dir is lkraven-owned and a DEFAULT ACL gives
|
|
# lkraven and nemi-drop rw on everything created inside, whoever drops it and whatever their umask.
|
|
steps:
|
|
- name: Group nemi-drop with lkraven and infra-ops
|
|
sudo: true
|
|
shell: |
|
|
getent group nemi-drop >/dev/null || groupadd nemi-drop
|
|
usermod -aG nemi-drop lkraven; usermod -aG nemi-drop infra-ops
|
|
getent group nemi-drop
|
|
- name: /srv/nemi (root:nemi-drop 0750) and /srv/nemi/inbox (lkraven:nemi-drop 2770, default ACL)
|
|
sudo: true
|
|
shell: |
|
|
install -d -o root -g nemi-drop -m 0750 /srv/nemi
|
|
setfacl -m u:lkraven:rx /srv/nemi # traversal for lkraven's user manager, whose groups predate nemi-drop
|
|
install -d -o lkraven -g nemi-drop -m 2770 /srv/nemi/inbox
|
|
setfacl -m u:lkraven:rwx,g:nemi-drop:rwx /srv/nemi/inbox
|
|
setfacl -d -m u::rwX,u:lkraven:rwX,g::rwX,g:nemi-drop:rwX,o::--- /srv/nemi/inbox
|
|
getfacl -p /srv/nemi/inbox
|
|
verify:
|
|
- name: Nemi's own context (lkraven's systemd user manager, groups fixed at boot) can list the inbox
|
|
shell: runuser -u lkraven -- env XDG_RUNTIME_DIR=/run/user/1000 systemd-run --user --wait --pipe -q ls -ld /srv/nemi/inbox
|
|
sudo: true
|
|
changed_when: "false"
|
|
- name: A file dropped by infra-ops is readable and removable by lkraven
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
f=/srv/nemi/inbox/.acl-probe-$$
|
|
runuser -u infra-ops -g nemi-drop -- sh -c "umask 077; echo probe > $f"
|
|
runuser -u lkraven -- cat "$f" >/dev/null
|
|
runuser -u lkraven -- rm -f "$f"
|
|
test ! -e "$f" && echo "infra-ops drop -> lkraven read+remove: ok"
|
|
changed_when: "false"
|