bastian/deploy_home
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(debyltech-cloud): lock customers to read-only, no discovery

Browse Source 
Customers are admin-created accounts in per-customer groups. They should
read what staff share with them and nothing else. Checked against a test
customer in the UI, and by running the sharee and contacts-menu search
services as that user.

- shareapi_exclude_groups=allow, list [admin]: only staff can share. Exclude
  mode ("yes") only disables sharing for users whose groups are ALL
  excluded, so it never catches a customer in their own group.
- User/group autocomplete off. By default a customer typing "bas" found the
  owner's account. Staff share by exact group name; LibreSign signers are
  found by email.
- New shares default to View only (shareapi_default_permissions=1).
- files default_quota 0 B, so customers get no personal storage. Staff in
  cloud_debyltech_staff_users are exempted (skipped if not yet created).
- No "Leon Green" sample contact in new address books.
- The verify script fails the deploy if any isolation setting drifts.
- README: staff and customer onboarding checklist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Bastian de Byl
2026-09-28 19:10:47 -04:00
co-authored by Claude Opus 5.5
parent be50798096
commit c4fe506860
4 changed files with 118 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/podman/templates/nextcloud/debyltechmail-verify.php.j2
+16
View File
@@ -149,6 +149,22 @@ if (!$emailOn) {
. 'cannot be added as signers ("No signers.")';
}
// Customer isolation (see the policy task in containers/debyltech/cloud.yml).
// A stray click in Settings > Sharing can undo any of these, and each one
// quietly re-exposes customers to one another or lets them share onward.
$isolation = [
'shareapi_exclude_groups' => 'allow',
'shareapi_exclude_groups_list' => json_encode(['{{ cloud_debyltech_staff_group }}']),
'shareapi_allow_share_dialog_user_enumeration' => 'no',
'shareapi_default_permissions' => '1',
];
foreach ($isolation as $key => $want) {
$have = \OC::$server->get(\OCP\IConfig::class)->getAppValue('core', $key, '<unset>');
if ($have !== $want) {
$failures[] = "core $key is \"$have\" -- expected \"$want\" (customer isolation)";
}
}
$identDocs = $appConfig->getValueString('libresign', 'identification_documents', '');
if ($identDocs !== '0') {
$failures[] = 'libresign identification_documents is "' . $identDocs