bitborg/bitborg-infra
Bevaka
2
0
Avgrena
Du har redan avgrenat bitborg-infra
 0
Kod Ärenden 64 Ändringsförfrågningar 3 Projekt 1 Utgåvor Paket Wiki Aktiviteter Actions

Entitlements fail open: group-less/JIT owners get unlimited quota (quota.default = -1) #120

Nytt ärende
Stängd
öppnade 2026-07-19 06:56:05 +00:00 av supernaut · 1 kommentar
supernaut kommenterad 2026-07-19 06:56:05 +00:00
Ägare
Kopiera länk

Severity: CRITICAL — surfaced by the pre-onboarding infra audit (2026-07-19).

#85 was closed intending to set [quota.default] TOTAL = 0 to close the fail-open window, but the fix could not land: the in-file comment (ansible/roles/forgejo/templates/app.ini.j2:183-197) records that on Forgejo 16 [quota.default] is composed restrictively for everyone (not just group-less users as on v15), so 0 broke all users — even members of unlimited groups couldn't push/merge. So TOTAL is back to -1 (unlimited) and the window #85 was meant to close is still open.

How it fails open

[quota.default] governs any owner in no quota group. It is -1 (unlimited). The reconciler (roles/reconciler, timer *:0/15) is the only thing that puts a user into a quota group.

  • A brand-new JIT account (first OIDC login) is unlimited until the next reconciler tick (~15 min, documented).
  • If the reconciler timer is dead / its token is wrong / a Kanidm read returns empty, new users stay group-less and therefore unlimited indefinitely. The system fails open — exactly wrong for open registration.

Ask

Close the JIT/reconciler-down window with a mechanism that survives the v16 restrictive-compose behaviour, e.g.:

  • assign the Forgejo quota group synchronously at signup (bitborg-web) or at JIT-provision, not on a 15-min lag; and/or
  • a Forgejo-side default that blocks uploads for group-less owners without blocking existing group members (needs a v16-correct knob — investigate [quota] group precedence).
  • MUST be paired with the reconciler deadman alert (separate issue) so a dead reconciler is detected, not silently fail-open.

Refs closed #85, ADR 0017/0029.

**Severity: CRITICAL** — surfaced by the pre-onboarding infra audit (2026-07-19). `#85` was closed intending to set `[quota.default] TOTAL = 0` to close the fail-open window, but the fix could not land: the in-file comment (`ansible/roles/forgejo/templates/app.ini.j2:183-197`) records that on **Forgejo 16** `[quota.default]` is composed restrictively for **everyone** (not just group-less users as on v15), so `0` broke all users — even members of unlimited groups couldn't push/merge. So `TOTAL` is back to **`-1` (unlimited)** and the window `#85` was meant to close is still open. ### How it fails open `[quota.default]` governs any owner in **no** quota group. It is `-1` (unlimited). The reconciler (`roles/reconciler`, timer `*:0/15`) is the only thing that puts a user into a quota group. - A brand-new JIT account (first OIDC login) is **unlimited** until the next reconciler tick (~15 min, documented). - If the reconciler timer is dead / its token is wrong / a Kanidm read returns empty, new users stay group-less and therefore **unlimited indefinitely**. The system fails open — exactly wrong for open registration. ### Ask Close the JIT/reconciler-down window with a mechanism that survives the v16 restrictive-compose behaviour, e.g.: - assign the Forgejo quota group **synchronously** at signup (bitborg-web) or at JIT-provision, not on a 15-min lag; and/or - a Forgejo-side default that blocks *uploads* for group-less owners without blocking existing group members (needs a v16-correct knob — investigate `[quota]` group precedence). - MUST be paired with the reconciler deadman alert (separate issue) so a dead reconciler is detected, not silently fail-open. Refs closed #85, ADR 0017/0029.
supernaut kommenterad 2026-07-19 20:32:15 +00:00
Upphovsperson
Ägare
Kopiera länk

✅ Resolved + verified live (2026-07-19, PRs #150 + #152).

Fail-closed default: [quota].DEFAULT_GROUPS = participant is live in the running Forgejo config. Verified via the admin quota API that it did NOT break anyone (the [quota.default]=0 incident is not reproduced):

  • Tier users unaffected — supernaut → lfs-basic (base = size:repos:all/assets:all -1, unlimited repos + tier LFS cap); kofish → lfs-xl (base -1 + 50 GiB LFS). Grouped users show ONLY their explicit group, so DEFAULT_GROUPS acts as a fallback for group-less owners only.
  • Platform org safe — gitborg → org-unlimited (size:all -1).
  • Group-less / new JIT owners now inherit the zero-quota participant group (browse + issues yes, uploads no) until the reconciler assigns their real tier — the intended fail-closed behaviour.

Defense-in-depth (PR #150): ReconcilerStale deadman alert (a dead reconciler that would silently stop entitlement sync is now detected) + reconcile interval 15 → 5 min (shrinks the group-less window). Forgejo healthy after the app.ini restart.

Rollback if ever needed: forgejo_quota_default_groups: "" + apply.

✅ **Resolved + verified live** (2026-07-19, PRs #150 + #152). **Fail-closed default:** `[quota].DEFAULT_GROUPS = participant` is live in the running Forgejo config. Verified via the admin quota API that it did NOT break anyone (the `[quota.default]=0` incident is not reproduced): - **Tier users unaffected** — `supernaut` → `lfs-basic` (`base` = `size:repos:all/assets:all -1`, unlimited repos + tier LFS cap); `kofish` → `lfs-xl` (`base -1` + 50 GiB LFS). Grouped users show ONLY their explicit group, so `DEFAULT_GROUPS` acts as a fallback for **group-less owners only**. - **Platform org safe** — `gitborg` → `org-unlimited` (`size:all -1`). - **Group-less / new JIT owners** now inherit the zero-quota `participant` group (browse + issues yes, uploads no) until the reconciler assigns their real tier — the intended fail-closed behaviour. **Defense-in-depth (PR #150):** `ReconcilerStale` deadman alert (a dead reconciler that would silently stop entitlement sync is now detected) + reconcile interval 15 → 5 min (shrinks the group-less window). Forgejo healthy after the app.ini restart. Rollback if ever needed: `forgejo_quota_default_groups: ""` + apply.
Logga in för att delta i denna konversation.
Ingen gren/etikett specificerad
Grenar Taggar
main
fix/log-retention-and-erasure
feat/billing-reconcile-trigger
chore/renovate-script-pins
Inga resultat hittades.
Etiketter
Rensa etiketter
  
area/backups
Backup & restore

  
area/ci
Actions / runners

  
area/control-panel
Logged-in self-service area

  
area/identity
Kanidm / OIDC / entitlements

  
area/infra
Infrastructure (OpenTofu/Ansible/host)

  
area/observability
Monitoring / logs / analytics

  
area/payments
Billing / payment providers

  
area/security
Security & compliance (incl. ISO 27001)

  
area/storage
Volumes / data / LFS

  
area/web
Public web portal (gitborg-web)

  
blocked
Evaluated and specified, but waiting on an external dependency

  
needs-info
Waiting on the reporter for more information

  
needs-triage
Not yet evaluated

  
ready-for-implementation
Fully specified, ready to be picked up

  
type
bug
 Something is broken

  
type
chore
 Maintenance / housekeeping

  
type
docs
 Documentation

  
type
epic
 High-level roadmap item

  
type
feature
 New capability

  
type
task
 Concrete unit of work

  
wontfix
Will not be actioned

Inga etiketter
area/backups
area/ci
area/control-panel
area/identity
area/infra
area/observability
area/payments
area/security
area/storage
area/web
blocked
needs-info
needs-triage
ready-for-implementation
type
bug
type
chore
type
docs
type
epic
type
feature
type
task
wontfix
Milstolpe
Rensa milstolpe
Inga objekt
Ingen milstolpe
Projekt
Rensa projekt
Inga objekt
Inget projekt
Bitborg Infrastructure
Tilldelade
Rensa tilldelade
Inga tilldelade
1 deltagare
Notiser
Förfallodatum
Förfallodatumet är ogiltigt eller utanför gränserna. Använd formatet "åååå-mm-dd".

Inget förfallodatum satt.

Beroenden

Inga beroenden satta

Referens
bitborg/bitborg-infra#120
Ingen beskrivning angiven.