Roadmap: onboard miquella to LDAP + ssh CA for gssh access

2026-05-03 20:47:57 +02:00
parent bd16db7e1d
commit edcc934177
1 changed files with 1 additions and 0 deletions
@@ -60,6 +60,7 @@ These don't block earlier phases, but capture them now so they're not forgotten.
 ### Identity & access

 - [ ] **Auto-mount user home folders on SSH connect.** Currently each user's `$HOME` is local to the host they SSH into. Want each user's home to be a NAS-backed share automounted on connect (NFS or autofs + LDAP user attribute). Should pair with the LDAP-backed SSSD setup (`Charlie/ldap`). Design before more users land.
+- [ ] **Miquella into the LDAP/SSH fold.** DSM is currently outside the SSSD-backed identity. Configure DSM's LDAP client to point at `Charlie/ldap`, trust the SSH signing CA (`/volume1/ubuntu/ca/ssh/ssh_user_ca.pub`), and accept ephemeral certs from gssh. Goal: malenia + miquella both onboarded into the gssh terminal flow with LDAP-driven access.
 - [ ] **Per-host git identity.** Each host needs its own credential to talk to Gitea — currently we paste a PAT inline. Decide: per-host PAT stored in the host's keyring, host-keyed SSH key registered as a deploy key on each `Charlie/<stack>` (rotation pain), or one "host-fleet" service account in Gitea with org-scope read + per-stack write.
 - [ ] **Per-repo permissions via LDAP-backed service accounts.** Use `Charlie/ldap` to provision service accounts (e.g. `svc-runner-morgott`, `svc-deploy-mediacompose`) that Gitea recognises through OIDC. Per-repo `read` / `write` / `admin` roles map to LDAP groups. Replaces the current "everything pushes as `amacocian`" pattern. Required before runners go live so a compromised runner has bounded blast radius.