Qortal-Nextcloud-Integration/scripts/automation/README-agent-executor.md

NuQloud Agent Executor (Least Privilege)

Use this pattern when a remote agent needs a few privileged host actions without granting full root/docker access.

Files

• scripts/automation/nuqloud-op: root-owned host wrapper command
• scripts/automation/nuqloud-op.sudoers: sudoers template

Install on a target host

sudo cp scripts/automation/nuqloud-op /usr/local/sbin/nuqloud-op
sudo chown root:root /usr/local/sbin/nuqloud-op
sudo chmod 0750 /usr/local/sbin/nuqloud-op
sudo visudo -f /etc/sudoers.d/nuqloud-op

Paste/adapt:

Defaults!/usr/local/sbin/nuqloud-op !setenv, noexec
openclaw-agent ALL=(root) NOPASSWD: /usr/local/sbin/nuqloud-op *

Then secure the sudoers file:

sudo chown root:root /etc/sudoers.d/nuqloud-op
sudo chmod 0440 /etc/sudoers.d/nuqloud-op

Supported actions

• broker-health
• invite-create <createdBy> <hours> [comment...]
• provision-upsert <qortalAddress> <email>

Example:

sudo /usr/local/sbin/nuqloud-op broker-health
sudo /usr/local/sbin/nuqloud-op invite-create ordersOps 24
sudo /usr/local/sbin/nuqloud-op invite-create ordersOps 24 "sent to jane@example.com"
sudo /usr/local/sbin/nuqloud-op provision-upsert QTESTADDRESS123 provision-test@example.com

Security notes

• Do not add automation users to the docker group (root-equivalent).
• Keep BROKER_INTERNAL_API_TOKEN only in .env.devprod on the target host.
• Prefer short-lived API tokens for external systems and rotate regularly.