GameCult/Idunn
Watch
9
0
Fork
You've already forked Idunn
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Grant Idunn exact StreamPixels deployment roots

Browse source
This commit is contained in:
Meta Vens 2026-09-27 23:35:51 +02:00
commit 02e27a1048
2 changed files with 12 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

11
README.md
View file

@ -174,11 +174,12 @@ the all-seer's view, not Idunn's contract, and the two sets do not overlap.
| `idunn-yggdrasil` | operator wrapper |
| `idunn-yggdrasil.sudoers` | the narrow sudo grant the wrapper needs |
The unit runs as a dedicated `idunn` user under `ProtectSystem=full`,
`ProtectHome=yes`, `PrivateTmp=yes`. `ReadWritePaths` is Idunn's own state plus
the build root; the operator anchor, the bindings, and Odin's correlation store
are all `ReadOnlyPaths`. Idunn admits against operator authority — it does not
author it.
The unit runs as root under `ProtectSystem=full`,
`ProtectHome=yes`, `PrivateTmp=yes`. `ReadWritePaths` contains Idunn's own state,
the build root, and only the runtime, state, and release roots explicitly
granted to each managed target. The operator anchor, bindings, and Odin's
correlation store remain read-only. Idunn admits against operator authority —
it does not author it.
Note `Wants=docker.service`, not `Requires=`. Only the build step is
containerized; warm, fence, promote, drain and restart run on systemd, and

9
deploy/idunn-yggdrasil.service
View file

@ -79,9 +79,8 @@ ReadWritePaths=/etc/ufw
# was inside the private root, where no workload could traverse to it.
ReadWritePaths=/var/lib/gamecult/idunn /var/lib/gamecult/idunn-authority /var/lib/gamecult/idunn-projection
ReadWritePaths=/srv/build
# One entry per managed target: its runtime root, state root and release root.
# A target Idunn cannot write is a target it cannot deploy, so this list grows
# by exactly three paths per migration and is the honest blast radius.
# Each managed target gets only its bound roots. A target Idunn cannot write is
# a target it cannot deploy; keep this list aligned with operator bindings.
ReadWritePaths=/etc/gamecult/heimdall /var/lib/gamecult/heimdall /srv/heimdall/app
# Odin is a managed target like any other now, so its three roots are writable
# on the same terms. This used to be ReadOnlyPaths, on the reasoning that Idunn
@ -97,6 +96,10 @@ ReadWritePaths=/etc/gamecult/odin /var/lib/gamecult/odin /srv/odin
# which also holds the credential originals Idunn reads but never writes.
# The release root sits beside the legacy v1 actuator's /srv/ghostlight.
ReadWritePaths=/etc/gamecult/ghostlight/runtime /var/lib/gamecult/ghostlight-world-v2 /srv/ghostlight-idunn
# StreamPixels service: runtime bundle, rebuildable state boundary, and releases.
ReadWritePaths=/etc/gamecult/streampixels-service/runtime /var/lib/gamecult/streampixels-service /srv/streampixels-idunn/releases/service
# StreamPixels web is stateless; it needs only its runtime bundle and releases.
ReadWritePaths=/etc/gamecult/streampixels-web/runtime /srv/streampixels-idunn/releases/web
[Install]
WantedBy=multi-user.target