# ops-agent config for the Mac build host (mbp).
#
# The agent listens ONLY on the tailnet interface and authorizes every request
# by resolving the caller via `tailscale whois`, then running the step under
# `caller-grant ∩ this-host-grant`. Copy to ~/.config/ops-agent/config.toml.

# Bind the tailnet address (not 0.0.0.0) so the agent is unreachable off-tailnet.
# Replace with mbp's actual tailnet IP. 8765 mirrors the ACL example.
listen = "100.64.0.2:8765"

# Root for `GET /pull`, which is how a driver retrieves the artifact it just had
# this host build. Required for that: with no pull_root, /pull answers 403
# "pull disabled: no pull_root configured", so a release builds, signs,
# notarizes, and staples, then fails at the final step. Every /pull request is
# confined under this root, so keep it to the artifacts tree -- NOT $HOME, which
# would expose ~/.tauri/passwords.env and the .p8 to any allow-listed caller.
# Omit the key entirely to leave /pull disabled.
#
# pull_root sets WHERE /pull may read; the `artifact` observe grant below sets
# WHO may read it. Both are required -- either one missing answers 403.
pull_root = "/Users/max/Dist"

# What THIS host is allowed to do — the ceiling for every caller. The Mac signs.
#
# observe kinds: `build-log` = read the build's log output; `artifact` = retrieve
# a built release artifact via /pull, confined to pull_root. They are separate on
# purpose -- a caller can be granted the DMG without the logs, or the reverse.
# A host that grants `sign` additionally gets `gatekeeper` implicitly (a signer
# must be able to verify its own signature, or every publish gate dead-ends), so
# /health on this host reports observe = ["build-log", "artifact", "gatekeeper"]
# even though only two are listed here. That is expected, not drift.
[grant]
actuate = ["build", "sign", "notarize", "staple", "package"]
observe = ["build-log", "artifact"]

# Callers this agent trusts. `identity` is a tailnet node name (e.g. `fw13`) or a
# tag (e.g. `tag:builder`). The effective grant is this list ∩ [grant] above.
[[allow]]
identity = "fw13"            # the Sando/Bento daemon host
actuate  = ["build", "sign", "notarize", "staple", "package"]
observe  = ["build-log", "artifact"]

# OPTIONAL script pins (minimal "signed recipe" control). For a high-risk action
# whose recipe is a fixed shell script, pin the exact script so an allow-listed
# caller cannot substitute an arbitrary command under that granted label (e.g.
# exfiltrate the signing key under `sign`). A `/run` step for a pinned action is
# refused unless it is `/bin/sh -c <script>` and `<script>` is listed in `allow`.
# Actions without a pin are unconstrained (the tailnet + capability perimeter
# above remains their only boundary). Pin only fixed-script actions — `build`
# steps vary per release and should NOT be pinned.
#
# [[pin]]
# action = "sign"
# allow  = [". /etc/bento/secrets.env && ./dist/release-macos.sh --keychain"]