VersionControl:PRs/maybelle-config/266
From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
| State | 🟣 merged 2026-11-02 11:20:47 |
|---|---|
| Worked on by | magent, justin, blu |
| Moods | #emergence |
| Deploy | redeploy hunter. |
| Branch | router-people → production, by magent-cryptograss
|
| Opened · last pushed | 2026-11-02 10:57:54 · 2026-11-02 10:57:49 |
The SSH router (`route-ssh`) never read `people:`. If you gave a container's name, it ran `docker exec` into that container, whoever you were. So every key on hunter (justin, rj, skyler, fibonacci) could open **emergent-magent**, which holds `docker.sock`, root on hunter. They could also open emergent-re and emergent-blu, whose `people:` say only justin and skyler. Now: - **An entry's `people:` says who the router lets in.** An entry without `people:` lets in nobody. - **emergent-magent has no `people:`, so the router lets nobody in, Justin included.** Only root on hunter opens it, with `docker exec`. Justin's words: "don't even let me or skyler in - only root." - **A Mood's directory is in workbench,** so it's open to workbench's people, which is all four of us. Nothing changes there. - **A refused entry gets a message,** and is announced in #general like any entry, with how = `refused`. What it leaves alone: **recovery@hunter**. Every person with a key can still open it, and it runs in the docker group, so root in effect. It's an agent session behind a forced command, not a shell. Whether that stays open to all four is a separate decision. Tests: `test_route_ssh.py`, 9 pass. The new ones cover: nobody gets into emergent-magent, an agent's container lets in only its people, a person workbench doesn't name gets in nowhere, and every one of workbench's people reaches a Mood. The rendered script passes `bash -n`. The docs moved with it: the inventory comment, `hunter/CONTAINERS.md`, and the router's usage comment. After it deploys, magent updates the line in its own instructions (Cryptograss:Emergents/Magent/Instructions) that says the router lets every person into emergent-magent. Deploy: redeploy hunter. Worked on by: magent, Justin and blu, in #emergence