diff options
| author | tv <tv@krebsco.de> | 2026-11-07 22:35:09 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-07 22:35:09 +0100 |
| commit | c82a62186a8e0a46fd41e08345a2fa3e54ddffe2 (patch) | |
| tree | 068e5bc12c7d13a51f7ba4a4e3e9723cbe33cc7e /docs/example.toml | |
| parent | a8ee17b7513c0367b5a9e5a30ae290fe53dad88b (diff) | |
access: authorization at the API
Every request is judged by the registry the node holds: store reads
pruned to what the user may read, writes refused where it may not,
admin endpoints by protocol capabilities. Without a registry, as
before (--protocol-writers for protocol data).
Auth plan M1.
Diffstat (limited to 'docs/example.toml')
| -rw-r--r-- | docs/example.toml | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/docs/example.toml b/docs/example.toml index 26be818..da808ec 100644 --- a/docs/example.toml +++ b/docs/example.toml @@ -80,9 +80,11 @@ htpasswd = "/etc/continuum/htpasswd" # trusted-proxies = ["127.0.0.1", "::1", "unix"] # HTTP API users (from htpasswd or user-header) who may write protocol data under /store/_continuum -# (remake records, members, forget records), e.g. to repair a stuck remake. Such writes -# act on the whole swarm and are logged. Epoch metadata and the swarm ID are never -# writable. +# (remake records, members, forget records), e.g. to repair a stuck remake, in a swarm +# without a user registry. Such writes act on the whole swarm and are logged. Epoch +# metadata and the swarm ID are never writable. With a registry its capabilities decide +# instead (docs/access.md); on a genesis node, those of htpasswd's users named here may +# do everything in the new swarm's registry. # protocol-writers = ["alice"] # With genesis: the new swarm's first users, each may do everything, protocol data and |