kacperor
6ed7a7f4d2
- Krok 9 (tmux): tee -> tee -a (nie nadpisuj configu), dodano focus-events on, poprawiono nazwę sesji na "bootstrap" - Krok 10: struktura katalogów odzwierciedla stan faktyczny (/srv i /srv/infra już istnieją, brakuje apps i data) - Krok 12: Claude Code oznaczony jako wykonany 20-08-2026, instalator natywny bez Node.js - Nowy Krok 14: audyt po bootstrapie (SSH, ufw, fail2ban, unattended-upgrades, swap, Docker, porty, klucze) - HANDOFF.md: poprawiona numeracja sekcji 6
64 lines
1.4 KiB
JSON
64 lines
1.4 KiB
JSON
{
|
|
"permissions": {
|
|
"defaultMode": "auto",
|
|
|
|
"additionalDirectories": [
|
|
"/srv/apps",
|
|
"/srv/data"
|
|
],
|
|
|
|
"ask": [
|
|
"Bash(rm -rf:*)",
|
|
"Bash(sudo rm:*)",
|
|
"Bash(sudo rm -rf:*)",
|
|
|
|
"Bash(docker volume rm:*)",
|
|
"Bash(docker volume prune:*)",
|
|
"Bash(docker system prune:*)",
|
|
"Bash(docker compose down -v:*)",
|
|
|
|
"Bash(sudo ufw:*)",
|
|
"Bash(sudo tee /etc/ssh:*)",
|
|
"Bash(sudo systemctl restart ssh:*)",
|
|
"Bash(sudo systemctl stop:*)",
|
|
"Bash(sudo systemctl disable:*)",
|
|
"Edit(/etc/ssh/**)",
|
|
"Write(/etc/ssh/**)",
|
|
"Edit(/etc/fail2ban/**)",
|
|
"Edit(/etc/sudoers*)",
|
|
"Write(/etc/sudoers*)",
|
|
|
|
"Bash(sudo reboot:*)",
|
|
"Bash(sudo shutdown:*)",
|
|
"Bash(sudo poweroff:*)",
|
|
|
|
"Bash(sudo adduser:*)",
|
|
"Bash(sudo useradd:*)",
|
|
"Bash(sudo deluser:*)",
|
|
"Bash(sudo usermod:*)",
|
|
"Bash(sudo passwd:*)",
|
|
"Edit(**/authorized_keys)",
|
|
"Write(**/authorized_keys)",
|
|
|
|
"Bash(dropdb:*)",
|
|
"Bash(psql:*)",
|
|
"Bash(mysql:*)",
|
|
"Bash(docker compose exec db:*)",
|
|
|
|
"Bash(git push --force:*)",
|
|
"Bash(git reset --hard:*)",
|
|
"Bash(git clean:*)"
|
|
],
|
|
|
|
"deny": [
|
|
"Read(**/.env)",
|
|
"Read(**/.env.*)",
|
|
"Read(**/*.pem)",
|
|
"Read(**/*.key)",
|
|
"Read(**/id_rsa*)",
|
|
"Read(**/id_ed25519*)",
|
|
"Read(**/acme.json)"
|
|
]
|
|
}
|
|
}
|