Add integration principles and architecture page
Add Netskope setup guide
Netskope tags compliant devices rather than allow-listing them, so the guide
leads with the label-versus-enforce split and the Netskope-side policy chain
the customer has to build for the tag to mean anything.
Documents the constraints that are invisible from the Hub UI: Linux devices
cannot be tagged (no provisioning device UID), a device already at Netskope's
five-tag cap silently loses EDAMAME's tag, Base URL takes a bare hostname, and
the tag marks compliant devices so the policy must allow on its presence.
Marked as not yet available in the index, since the provider is not selectable
in Hub yet while the tenant-side steps can be prepared now.
Correct the JSON configuration contract, add FortiGate guide, add navigation
The JSON configuration guide described a schema the trigger engine does not
accept. Corrected against the deserialisation types in
edamame-services/services-core/src/value_objects/access_control/config_file.rs
and the executors that consume them:
- rest and graphql inside add_action / delete_action are arrays, not single
objects. The documented shape panics on deserialisation. auth.rest stays a
single object, which is the one genuine asymmetry.
- The device identifier placeholder is ${ENV.user.deviceId}, not device_id.
An unrecognised attribute name silently interpolates an empty string.
- Documented the attributes that were missing entirely: ipv4, ipv6, username,
peerIds.<key>, and the six ${ENV.internal.*} whole-list placeholders.
- Documented the built-in "internal" action form and the bypass_error /
bypass_certificate flags, including why bypass_error hides real failures.
- Replaced the blanket "case-insensitive" claim on rest_type with the spellings
actually accepted.
New FortiGate guide. The integration has shipped and is offered in Hub, but had
no documentation. It is also the only MAC-based provider, so the L2 adjacency
requirement needed writing down.
NetBird and Tailscale guides gain the device-side prerequisites they were
missing: the provider's client must be installed and connected, and the agent
needs elevation to read the peer identity. Neither failure reports an error, so
without this a stalled rollout has no visible cause. The Tailscale guide also
now states up front that the integration acts on the entire tailnet and will
deauthorize non-compliant devices, including servers and CI runners.
Home was a one-line stub while being the wiki's landing page; it is now an index
with a provider-to-Hub-label mapping, since those names differ. Added _Sidebar
for navigation, and repointed Access-control-Documentation, which the Hub links
to directly, at the index instead of dead-ending.