phd-software/cumulus
Watch
1
0
Fork
You've already forked cumulus
 0
Code Pull requests Activity Actions

Authenticate pangolin-client with machine credentials #62

Merged
parker merged 1 commit from pangolin-client-machine-auth into main 2026-10-16 21:59:12 -06:00
Conversation 0 Commits 1 Files changed 3 +21 -6
parker commented 2026-10-16 21:59:09 -06:00
Owner
Copy link

Authenticate pangolin-client with machine credentials

Replace the one-time interactive pangolin login with machine-client
credentials (RAZER_MACHINE_*), ending all login state in containers.
Machine access is per-resource in the dashboard: a machine has no role
or standing permission, so for each private resource it needs, it must
be added to that resource's Machine Clients list. Without any grant
the client connects but no tunnel peer forms, and --org is a
user-session flag machines must never take (USER_ID_NOT_FOUND). The
interactive login this replaces died in the working tree: a fresh
clone of the fleet repo erased pangolin-client-config and crash-looped
the agent. Beelink and tower need the same compose change and their
machine credentials wired (keys already in .env).

Authenticate pangolin-client with machine credentials Replace the one-time interactive pangolin login with machine-client credentials (RAZER_MACHINE_*), ending all login state in containers. Machine access is per-resource in the dashboard: a machine has no role or standing permission, so for each private resource it needs, it must be added to that resource's Machine Clients list. Without any grant the client connects but no tunnel peer forms, and --org is a user-session flag machines must never take (USER_ID_NOT_FOUND). The interactive login this replaces died in the working tree: a fresh clone of the fleet repo erased pangolin-client-config and crash-looped the agent. Beelink and tower need the same compose change and their machine credentials wired (keys already in .env).
Replace the one-time interactive pangolin login with machine-client
credentials (RAZER_MACHINE_*), ending all login state in containers.
Machine access is per-resource in the dashboard: a machine has no role
or standing permission, so for each private resource it needs, it must
be added to that resource's Machine Clients list. Without any grant
the client connects but no tunnel peer forms, and --org is a
user-session flag machines must never take (USER_ID_NOT_FOUND). The
interactive login this replaces died in the working tree: a fresh
clone of the fleet repo erased pangolin-client-config and crash-looped
the agent. Beelink and tower need the same compose change and their
machine credentials wired (keys already in .env).
parker merged commit 50890368b2 into main 2026-10-16 21:59:12 -06:00
parker deleted branch pangolin-client-machine-auth 2026-10-16 21:59:12 -06:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
phd-software/cumulus!62
No description provided.