Skip to content

docs(agentcompute): record service deployment and Studio access #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmgilman merged 2 commits into from
Sep 15, 2026
Merged

docs(agentcompute): record service deployment and Studio access #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b14412f
docs(agentcompute): record service deployment and Studio access
jmgilman Sep 15, 2026
15006b0
docs(agentcompute): force IPv4 for source-pinned SSH
jmgilman Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/docs/reference/networking/address-plan.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@ by the `GilmanLab/fleet` `cluster/` project and mirrored in each node's seed.
| `sw-mgmt01` management | `10.10.70.2` | Interface address |
| `gw01` `glab.lol` mirror | `10.10.10.54` | Local service address |
| `ovncentral01` OVN central | `10.10.10.15` | Static VM interface on `nas01`'s unmanaged `mgmt` bridge |
| `agentcompute01` MCP service | `10.10.10.16` | Static `/32` on a routed Incus NIC through `lab01`'s `_vmgmt` interface; host gateway `169.254.0.1` |

### Hosts

Expand Down
15 changes: 15 additions & 0 deletions docs/docs/reference/networking/tailscale-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ and trailing commas. Section syntax is documented in Tailscale's
| --- | --- | --- |
| `tag:subnet-router` | Devices that advertise lab and home subnet routes into the tailnet | `autogroup:admin` |
| `tag:sandbox` | Sandbox hosts that accept advertised lab subnet routes | `autogroup:admin` |
| `tag:agentcompute` | Durable agentcompute HTTPS service | `autogroup:admin` |

A tagged device is owned by its tag, not by the user who registered it. Removing
a tag from the policy while a device still carries it leaves that device without
Expand Down Expand Up @@ -77,6 +78,20 @@ Policy tests require access to all four API endpoints and deny adjacent
addresses and ports. Other routed destinations remain denied unless a separate
rule permits them.

The agentcompute service uses these additional rules:

| Source | Destination | Protocol | Port |
| --- | --- | --- | --- |
| `autogroup:member` | `tag:agentcompute` | TCP | `443` |
| `tag:agentcompute` | `studio-1` (`100.122.142.76`) | TCP | `22` |

`studio-1` is a host alias for a user-owned device, not a device tag. Do not
retag Studio. The existing `autogroup:admin` → `*:*` rule is unchanged.
Policy tests allow the two service flows and deny service-to-Studio VNC,
service-to-other-host SSH, and sandbox-to-Studio SSH. OpenSSH separately
source-pins the service key; see the
[Studio authorization runbook](../../runbooks/agentcompute-studio-ssh.md).

## Credentials

CI authenticates with a Tailscale
Expand Down
Loading