From 459a0c64b8035500ed9e7d5cfb618270e194f554 Mon Sep 17 00:00:00 2001 From: lead Date: Fri, 3 Jul 2026 09:50:48 +0000 Subject: [PATCH] @lead: node1-ssh skill points to homelab opencode.json allowlist instead of inventing one --- .gitea/workflows/agent.yml | 35 +++++++++++++++++------------------ 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/.gitea/workflows/agent.yml b/.gitea/workflows/agent.yml index fb99fae..1b6ab2b 100644 --- a/.gitea/workflows/agent.yml +++ b/.gitea/workflows/agent.yml @@ -172,44 +172,43 @@ jobs: cat > ~/.config/opencode/skills/node1-ssh/SKILL.md <<'SKILLET' --- name: node1-ssh - description: Read-only diagnostics on the swarm node — use when debugging a deploy or checking a running service. + description: Read-only diagnostics on the swarm host via `ssh node1 …` — use when debugging a deploy or checking a running service. domains: [swarm] tags: [ssh, swarm, diagnostics, docker] --- # `node1-ssh` Skill - Use this skill to run read-only commands against **node1** (the Docker Swarm host) when: + Use this skill to run **read-only** commands against **node1** (the Docker Swarm host) when: - A deploy failed and you need to inspect running services. - You need to see a service's logs for debugging. - - An agent on homelab can't be reached and you want to check the stack from another node. + - You want to check the state of the stack on the swarm. ## How it works - Commands run via `ssh node1 `. The SSH alias is set up in `${HOME}/.ssh/config` + Commands run via `ssh node1 `. The SSH alias is configured in `${HOME}/.ssh/config` during this workflow (only when swarm secrets are configured for the caller repo). - Read access is enforced by the homelab repo's own OpenCode allowlist: **no other ssh hosts or any write commands on node1 are permitted**. - ## Allowed commands + ## What you're actually allowed to run — the allowlist is the source of truth - The following read-only commands work via `ssh node1`. Wrap your command in single quotes and escape any `$` signs used inside the remote shell. + This skill does **not** define which commands are permitted, and you must not assume a fixed + list here. The single source of truth for exactly which `ssh node1 …` commands are allowed is + the **caller repo's own OpenCode permission config** (e.g. `opencode.json` in the homelab repo: + a `deny "ssh *"` with specific `allow "ssh node1 …"` entries, last-match-wins). - - List services: `docker service ls` - - Service details: `docker service ps [--format ...]` - - View logs: `docker service logs [--tail N] [--since 24h] [--timestamps]` - - Network info: `docker network ls`, `docker network inspect ` - - Volumes: `docker volume ls [-f dangling=true]` - - Swarm nodes: `docker node ls`, `docker node inspect self`, `docker node ps --host node1` - - The same read-only constraint applies — write commands on node1 are rejected by the allowlist even if they appear in other allowlists. + - Only read-only diagnostics are permitted; any write/mutating command on node1 is denied. + - The permission layer enforces this — if a command is not on the caller's allowlist it will be + blocked, regardless of what this skill or any other allowlist says. + - So: reach for `ssh node1 …` for read-only diagnostics, and treat the caller's `opencode.json` + `ssh node1` allow-entries as the authoritative list of what will actually run. ## Example - > The frontend returned a 5xx after deploy #47. + > The frontend returned a 5xx after a deploy. > - > Action: + > Action (a read-only log inspection, subject to the caller's allowlist): > ``` - > ssh node1 "docker service logs --tail 100 --timestamps frontend" + > ssh node1 "docker service logs --tail 100 --timestamps homelab_frontend" > ``` SKILLET chmod -R o=rX ~/.config/opencode/skills/node1-ssh