lyuksovannyy
bfbc3c66e4
- Settings → Remote devices → Node: type master|slave (stored in state, beats config role; Restart DSH button under systemd/launchd), origin (read-only: own origin / paired master), 'Master has an auth middleware' toggle - middleware on: a non-DSH answer on the link (login redirect, 401/403, inline HTML) raises auth-required; the UI opens <master>/dsh-remote/signin in a popup, the user signs in to the proxy, one click hands the proxy session cookie back (postMessage, origin-checked, trusted origins only), link retries - edge mode 'cookie': pasted authentik_proxy_… (or a whole Cookie header), rotated proxy cookies persisted back; pair.mjs/install-mac --edge cookie - connectMaster serialised; a failed attempt never clears a finished link - tests: cookie seed/mode, HTML login wall; e2e-signin against a fake proxy
38 lines
1.7 KiB
YAML
38 lines
1.7 KiB
YAML
- insert:
|
|
- id: dsh-remote
|
|
name: '@local/dsh-remote'
|
|
config:
|
|
# master | slave | auto (auto = slave once paired with a master, else master)
|
|
role: auto
|
|
# Display name of this device (defaults to the hostname); its id is the slug of it.
|
|
deviceName: ''
|
|
# Shown in the Devices page so other machines know where to pair.
|
|
lanUrl: ''
|
|
publicUrl: ''
|
|
# Extra browser origins allowed to receive the proxy session from /dsh-remote/signin
|
|
# (loopback and private-network origins are always allowed).
|
|
signInOrigins: []
|
|
sync:
|
|
# slave: pull plugins/config automatically on link-up and when the master pushes.
|
|
auto: true
|
|
# slave: bundle allow/deny lists (exact names or prefix*). deny wins.
|
|
allow: []
|
|
deny: []
|
|
# slave: names of credential refs to accept from the master (opt-in, per secret).
|
|
# FORGE_CREDENTIALS = the master's Gitea/Forgejo (tea) logins + git https credentials.
|
|
secrets: []
|
|
# master: credential refs offered to devices (each device still opts in on the master
|
|
# Devices page AND locally via `secrets` above).
|
|
offerSecrets: []
|
|
# master: never sync these bundles / cordis.patch.yml entry ids.
|
|
excludeBundles: []
|
|
excludePatchIds: []
|
|
agentTools:
|
|
# Register remote_devices / remote_exec / remote_file / remote_task.
|
|
# Unset = on for the master only; true = also on a slave.
|
|
# tools: true
|
|
# false = refuse agent control of THIS device (exec/files/tasks from the master).
|
|
enabled: true
|
|
# master: let slaves relay agent ops to other devices.
|
|
allowPeerControl: false
|