scriptoriumadmin/hypertwist
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Clarify dev package-management sudo lane

Browse source
This commit is contained in:
axiomlogicnexus 2026-05-31 02:36:37 +02:00
parent 5aafbb47a4
commit ab0d4714db
2 changed files with 25 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
docs/ops/HYPERTWIST_REMOTE_DEVELOPMENT_REGISTRATION_PLAN_JETBRAINS_GATEWAY_2026_1_2_AND_VISUAL_STUDIO_2022_2026-05-30.md
View file

@ -25,6 +25,11 @@ The following is already true:
`root`
- `dev` is in `sudo` and `docker`, so normal development and container
operations do not require a root IDE session
- `dev` and `deploy` password logins remain locked; SSH key auth is the live
login path
- `dev` now has a narrow `NOPASSWD` sudoers rule for package-management
commands (`apt`, `apt-get`, `apt-cache`, `apt-mark`), so future package
installs do not require abandoning the remote-development session
- local SSH alias exists:
- `scriptoriumai-new-dev`
- local JetBrains/Gateway-compatible key path:
@ -95,8 +100,10 @@ Operational boundary:
- use `dev` for JetBrains Gateway, Rider, terminal development, and Visual
Studio remote registration
- use `dev` for `VS Code Remote-SSH` sessions as well
- use `root` only for system administration, package installation, certbot,
service repair, and recovery work
- use `dev` for routine `sudo apt ...` package management now that the narrow
`NOPASSWD` rule exists
- use `root` for broader system administration, certbot, service repair,
account recovery, and privileged tasks outside that package-management lane
## Canonical remote folder roots

18
docs/ops/HYPERTWIST_VPS_POST_CUTOVER_OPERATIONAL_INVARIANTS_2026-05-30.md
View file

@ -61,12 +61,26 @@ Current privilege state:
- `dev` is in `docker`
- `deploy` is in `sudo`
- `deploy` is in `docker`
- `dev` password login is locked
- `deploy` password login is locked
- both additive users currently authenticate by SSH key, not by a usable Unix
password
- `dev` now has a narrow `NOPASSWD` sudoers rule for package-management
commands:
- `/usr/bin/apt`
- `/usr/bin/apt-get`
- `/usr/bin/apt-cache`
- `/usr/bin/apt-mark`
Operational rule:
- IDE sessions, terminal development, and remote Git work should use `dev`
- `root` stays reserved for admin, certbot, package-management, and recovery
work
- `dev` may perform routine package-management operations with `sudo apt ...`
and related read-only `apt-cache` / `apt-mark` commands without an
interactive password prompt
- `root` remains the required lane for broader system administration, certbot,
service repair, account recovery, and any privileged task outside the narrow
package-management sudoers rule
- the current practical default remote-development lane is now `VS Code
Remote-SSH` for agent-first work