VersionControl:PRs/maybelle-config/266 - Revision history

DrivingThatTrain: cryptograss/maybelle-config#266, as GitHub has it

2026-11-09T17:06:27Z

cryptograss/maybelle-config#266, as GitHub has it

← Older revision		Revision as of 17:06, 9 November 2026
Line 16:		Line 16:
	\|deploy=redeploy hunter.		\|deploy=redeploy hunter.
	}}		}}
			<pre class="pr-body">The SSH router (`route-ssh`) never read `people:`. If you gave a container's name, it ran `docker exec` into that container, whoever you were. So every key on hunter (justin, rj, skyler, fibonacci) could open emergent-magent, which holds `docker.sock`, root on hunter. They could also open emergent-re and emergent-blu, whose `people:` say only justin and skyler.

			Now:
			- An entry's `people:` says who the router lets in. An entry without `people:` lets in nobody.
			- emergent-magent has no `people:`, so the router lets nobody in, Justin included. Only root on hunter opens it, with `docker exec`. Justin's words: "don't even let me or skyler in - only root."
			- A Mood's directory is in workbench, so it's open to workbench's people, which is all four of us. Nothing changes there.
			- A refused entry gets a message, and is announced in #general like any entry, with how = `refused`.

			What it leaves alone: recovery@hunter. Every person with a key can still open it, and it runs in the docker group, so root in effect. It's an agent session behind a forced command, not a shell. Whether that stays open to all four is a separate decision.

			Tests: `test_route_ssh.py`, 9 pass. The new ones cover: nobody gets into emergent-magent, an agent's container lets in only its people, a person workbench doesn't name gets in nowhere, and every one of workbench's people reaches a Mood. The rendered script passes `bash -n`.

			The docs moved with it: the inventory comment, `hunter/CONTAINERS.md`, and the router's usage comment. After it deploys, magent updates the line in its own instructions (Cryptograss:Emergents/Magent/Instructions) that says the router lets every person into emergent-magent.

			Deploy: redeploy hunter.
			Worked on by: magent, Justin and blu, in #emergence</pre>

DrivingThatTrain: cryptograss/maybelle-config#266, as GitHub has it

2026-11-02T11:50:07Z

cryptograss/maybelle-config#266, as GitHub has it

← Older revision		Revision as of 11:50, 2 November 2026
Line 5:		Line 5:
	\|url=https://github.com/cryptograss/maybelle-config/pull/266		\|url=https://github.com/cryptograss/maybelle-config/pull/266
	\|author=magent-cryptograss		\|author=magent-cryptograss
	\|state=~~open~~		\|state=merged
	\|base=production		\|base=production
	\|branch=router-people		\|branch=router-people
	\|opened=2026-11-02 10:57:54		\|opened=2026-11-02 10:57:54
	\|pushed=2026-11-02 10:57:49		\|pushed=2026-11-02 10:57:49
	\|merged=		\|merged=2026-11-02 11:20:47
	\|closed=		\|closed=
	\|worked_on_by=magent, justin, blu		\|worked_on_by=magent, justin, blu

DrivingThatTrain: cryptograss/maybelle-config#266, as GitHub has it

2026-11-02T10:57:57Z

cryptograss/maybelle-config#266, as GitHub has it

New page

{{PR
|repo=maybelle-config
|number=266
|title=Router: a container lets in only the people its people: names; emergent-magent, nobody
|url=https://github.com/cryptograss/maybelle-config/pull/266
|author=magent-cryptograss
|state=open
|base=production
|branch=router-people
|opened=2026-11-02 10:57:54
|pushed=2026-11-02 10:57:49
|merged=
|closed=
|worked_on_by=magent, justin, blu
|moods=emergence
|deploy=redeploy hunter.
}}