38 lines
844 B
HCL
38 lines
844 B
HCL
|
// Policy for BETA's render identity on vps2. Mirror of tg-host-prod.hcl.
|
||
|
|
//
|
||
|
|
// Beta legitimately reads the shared set: unlike dev, beta is on vps2 and already
|
||
|
|
// co-resident with prod, so withholding `shared` from it would buy nothing while
|
||
|
|
// breaking the render (beta's 24 live keys = beta.yaml's 8 + shared's 16).
|
||
|
|
|
||
|
|
path "thermograph/data/common" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/metadata/common" {
|
||
|
|
capabilities = ["read", "list"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/data/env/beta" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/metadata/env/beta" {
|
||
|
|
capabilities = ["read", "list"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/data/env/prod" {
|
||
|
|
capabilities = ["deny"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "thermograph/data/env/dev" {
|
||
|
|
capabilities = ["deny"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "auth/token/lookup-self" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "auth/token/renew-self" {
|
||
|
|
capabilities = ["update"]
|
||
|
|
}
|