| 1 |
# ops-agent config for the Mac build host (mbp). |
| 2 |
# |
| 3 |
# The agent listens ONLY on the tailnet interface and authorizes every request |
| 4 |
# by resolving the caller via `tailscale whois`, then running the step under |
| 5 |
# `caller-grant ∩ this-host-grant`. Copy to ~/.config/ops-agent/config.toml. |
| 6 |
|
| 7 |
# Bind the tailnet address (not 0.0.0.0) so the agent is unreachable off-tailnet. |
| 8 |
# Replace with mbp's actual tailnet IP. 8765 mirrors the ACL example. |
| 9 |
listen = "100.64.0.2:8765" |
| 10 |
|
| 11 |
# Root for `GET /pull`, which is how a driver retrieves the artifact it just had |
| 12 |
# this host build. Required for that: with no pull_root, /pull answers 403 |
| 13 |
# "pull disabled: no pull_root configured", so a release builds, signs, |
| 14 |
# notarizes, and staples, then fails at the final step. Every /pull request is |
| 15 |
# confined under this root, so keep it to the artifacts tree -- NOT $HOME, which |
| 16 |
# would expose ~/.tauri/passwords.env and the .p8 to any allow-listed caller. |
| 17 |
# Omit the key entirely to leave /pull disabled. |
| 18 |
# |
| 19 |
# pull_root sets WHERE /pull may read; the `artifact` observe grant below sets |
| 20 |
# WHO may read it. Both are required -- either one missing answers 403. |
| 21 |
pull_root = "/Users/max/Dist" |
| 22 |
|
| 23 |
# What THIS host is allowed to do — the ceiling for every caller. The Mac signs. |
| 24 |
# |
| 25 |
# observe kinds: `build-log` = read the build's log output; `artifact` = retrieve |
| 26 |
# a built release artifact via /pull, confined to pull_root. They are separate on |
| 27 |
# purpose -- a caller can be granted the DMG without the logs, or the reverse. |
| 28 |
# A host that grants `sign` additionally gets `gatekeeper` implicitly (a signer |
| 29 |
# must be able to verify its own signature, or every publish gate dead-ends), so |
| 30 |
# /health on this host reports observe = ["build-log", "artifact", "gatekeeper"] |
| 31 |
# even though only two are listed here. That is expected, not drift. |
| 32 |
[grant] |
| 33 |
actuate = ["build", "sign", "notarize", "staple", "package"] |
| 34 |
observe = ["build-log", "artifact"] |
| 35 |
|
| 36 |
# Callers this agent trusts. `identity` is a tailnet node name (e.g. `fw13`) or a |
| 37 |
# tag (e.g. `tag:builder`). The effective grant is this list ∩ [grant] above. |
| 38 |
[[allow]] |
| 39 |
identity = "fw13" # the Sando/Bento daemon host |
| 40 |
actuate = ["build", "sign", "notarize", "staple", "package"] |
| 41 |
observe = ["build-log", "artifact"] |
| 42 |
|
| 43 |
# OPTIONAL script pins (minimal "signed recipe" control). For a high-risk action |
| 44 |
# whose recipe is a fixed shell script, pin the exact script so an allow-listed |
| 45 |
# caller cannot substitute an arbitrary command under that granted label (e.g. |
| 46 |
# exfiltrate the signing key under `sign`). A `/run` step for a pinned action is |
| 47 |
# refused unless it is `/bin/sh -c <script>` and `<script>` is listed in `allow`. |
| 48 |
# Actions without a pin are unconstrained (the tailnet + capability perimeter |
| 49 |
# above remains their only boundary). Pin only fixed-script actions — `build` |
| 50 |
# steps vary per release and should NOT be pinned. |
| 51 |
# |
| 52 |
# [[pin]] |
| 53 |
# action = "sign" |
| 54 |
# allow = [". /etc/bento/secrets.env && ./dist/release-macos.sh --keychain"] |
| 55 |
|