eric/ansible-workspace-dnd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prepare the managed credential implementation sprint

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-16 19:12:42 +00:00
parent 6d9b4b87f8
commit 358051af98
5 changed files with 1041 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/decisions/0002-shared-readable-pipeline-filesystem-policy.md
View File

@@ -48,6 +48,13 @@ file modes are `0750` and `0640`, respectively, with
shared credentials. Configuration may contain credential reference names but
never raw credential values.
Narratio's general operational guidance recommends `0700` directories and
`0600` files for a single-user credential store. The suite deliberately grants
group read/traverse access instead: membership in the selected `narratio`
runtime group authorizes both pipeline execution and use of its shared provider
credentials. Deployments that do not trust every group member require a
different per-user credential policy and are outside this decision.
Version-controlled campaign and prompt assets may remain root-managed because
Git is authoritative, but they are world-readable. The suite does not add
confidentiality controls to non-secret D&D content.