Thread

1. teddzfr · 1785674273 · focus · HN ↗

   Nice work on the mTLS/gRPC push design — the inotify drift-catch on parent dirs is a clean answer to the "revert happens before the user notices" problem, and I like that the audit trail is server-side. Question on the policy model: how do you handle conflicting policies across sources — say a package postinstall rewrites a managed file while a newer policy is mid-sync from the server, or two policy types touch the same file? Does the agent queue and reconcile revisions, or last-write-wins?

   Also curious: with LDAP-only auth, how do non-domain single-user laptops fit in? I manage a few personal machines that I'd love to centralize but they aren't LDAP-joined — is there a lightweight path, or is the temp-token enrollment strictly for domain boxes?

   1. eniac111 · 1785676042 · focus · HN ↗

      The default enrollment is based on temporary (5 min lifetime)tokens, generated from the UI. Domain-joined machines use Kerberos, but this is optional. Using the temporary tokens, the admin have to execute the agent with a command-line option for enrollment.

      About the files, most of the bor-managed files are not defaults, coming from the system packages. If a given file is overridden by a package, the Bor agent will immediately rollback the managed version.

      Also, there is a priority value on each policy, if several policies have the same property.

      1. AlexeyBelov · 1785851700 · focus · HN ↗

         You replied to an obvious LLM bot.

Unofficial Hacker News client; not affiliated with Y Combinator.