admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

host-install v1.13.0: systemd-journal group for the agent user + NAS feature doc

Browse Source 
The NAS verify pipeline (agent v0.81.0) reads mount-unit journals unprivileged
— group membership, NO sudoers grant. Fixes the v1.11.0/1.12.0 header drift.
New authoritative feature doc documentation/controller/network-storage-nas.md
(verify pipeline, §8 truth table, Q4 error taxonomy, retry=0, Route A recipes
incl. the chmod-persists nuance).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-11 10:10:16 +02:00
parent e80e14d674
commit 27e2fb05c0
3 changed files with 152 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/CHANGELOG.md
+11
View File
@@ -1,5 +1,16 @@
# Felhom scripts — Changelog
## felhom-host-install v1.13.0 — systemd-journal group for the agent user (NAS verify) (2026-07-11)
- The agent-user setup now adds `felhom-agent` to the **`systemd-journal` group** (idempotent
`usermod -aG`): the NAS verify-before-commit pipeline (agent v0.81.0) classifies mount failures
from an UNPRIVILEGED `journalctl -u <unit>` read — group membership instead of a sudoers grant
(rule: no journalctl via sudo). Existing installs get the one-liner
`usermod -aG systemd-journal felhom-agent && systemctl restart felhom-agent` (applied to the
demo host during this task's live validation; Peti's box only when the NAS feature reaches him).
- Version-header drift fixed: the file header still said v1.11.0 while `SCRIPT_VERSION` was
1.12.0 (the v1.12.0 bump shipped without a changelog entry or header sync); both now 1.13.0.
## felhom-host-install v1.11.0 — uninstaller gap-closure + operator-key day-0 fold (TASK GL-4, go-live G6 + G1-follow-up) (2026-07-08)
- **Uninstall gap-closure (G6):**
scripts/felhom-host-install.sh
+15 -2
View File
@@ -1,6 +1,6 @@
#!/bin/bash
#===============================================================================
# felhom-host-install.sh v1.11.0
# felhom-host-install.sh v1.13.0
# Day-0 host-bootstrap for a Felhom Proxmox host (operator-deploy model).
#
# Run by the operator on a FRESHLY-PVE-INSTALLED box (after a manual PVE install
@@ -163,7 +163,7 @@
set -euo pipefail
SCRIPT_VERSION="1.12.0" # keep in sync with the header line at the top of this file
SCRIPT_VERSION="1.13.0" # keep in sync with the header line at the top of this file
# Operator signing keys pinned at day-0 (GL-4; doc 04 §3 two-key model). EMPTY by default — the pin
# CEREMONY is an operator step: generate the real keypairs OFFLINE, then fill these four constants
@@ -1697,6 +1697,19 @@ step_agent_install() {
log_success " created service user $AGENT_USER"
fi
# systemd-journal group: the NAS verify pipeline (agent v0.81.0) classifies mount failures from
# an UNPRIVILEGED `journalctl -u <unit>` read — group membership instead of a sudoers grant
# (rule: no journalctl via sudo). Idempotent. Existing installs: run the usermod by hand, then
# `systemctl restart felhom-agent`.
if $DRY_RUN; then
log_dry "usermod -aG systemd-journal $AGENT_USER"
elif id -nG "$AGENT_USER" | tr ' ' '\n' | grep -qx systemd-journal; then
log_info " $AGENT_USER already in systemd-journal"
else
usermod -aG systemd-journal "$AGENT_USER"
log_success " added $AGENT_USER to systemd-journal (unprivileged journal read for NAS verify)"
fi
# State dir (the old root deployment may have created it root-owned; StateDirectory= also adjusts
# on start, but chown here so the very first start has a writable dir).
run mkdir -p "$AGENT_STATE_DIR"