53 lines
1.5 KiB
Markdown
53 lines
1.5 KiB
Markdown
# NuQloud Agent Executor (Least Privilege)
|
|
|
|
Use this pattern when a remote agent needs a few privileged host actions without granting full root/docker access.
|
|
|
|
## Files
|
|
|
|
- `scripts/automation/nuqloud-op`: root-owned host wrapper command
|
|
- `scripts/automation/nuqloud-op.sudoers`: sudoers template
|
|
|
|
## Install on a target host
|
|
|
|
```bash
|
|
sudo cp scripts/automation/nuqloud-op /usr/local/sbin/nuqloud-op
|
|
sudo chown root:root /usr/local/sbin/nuqloud-op
|
|
sudo chmod 0750 /usr/local/sbin/nuqloud-op
|
|
sudo visudo -f /etc/sudoers.d/nuqloud-op
|
|
```
|
|
|
|
Paste/adapt:
|
|
|
|
```sudoers
|
|
Defaults!/usr/local/sbin/nuqloud-op !setenv, noexec
|
|
openclaw-agent ALL=(root) NOPASSWD: /usr/local/sbin/nuqloud-op *
|
|
```
|
|
|
|
Then secure the sudoers file:
|
|
|
|
```bash
|
|
sudo chown root:root /etc/sudoers.d/nuqloud-op
|
|
sudo chmod 0440 /etc/sudoers.d/nuqloud-op
|
|
```
|
|
|
|
## Supported actions
|
|
|
|
- `broker-health`
|
|
- `invite-create <createdBy> <hours> [comment...]`
|
|
- `provision-upsert <qortalAddress> <email>`
|
|
|
|
Example:
|
|
|
|
```bash
|
|
sudo /usr/local/sbin/nuqloud-op broker-health
|
|
sudo /usr/local/sbin/nuqloud-op invite-create ordersOps 24
|
|
sudo /usr/local/sbin/nuqloud-op invite-create ordersOps 24 "sent to jane@example.com"
|
|
sudo /usr/local/sbin/nuqloud-op provision-upsert QTESTADDRESS123 provision-test@example.com
|
|
```
|
|
|
|
## Security notes
|
|
|
|
- Do not add automation users to the `docker` group (root-equivalent).
|
|
- Keep `BROKER_INTERNAL_API_TOKEN` only in `.env.devprod` on the target host.
|
|
- Prefer short-lived API tokens for external systems and rotate regularly.
|