Correct the MAC-rotation claim, add the reverse-proxy ingress option
The agent re-reads the MAC on the same cache as the IP and reports it on
the next score report, and the address object is named after the device
rather than its MAC, so a rotation updates the object instead of breaking
the key. Cost is a propagation window, not a failed match.
On-premise ingress can also be a reverse proxy, as done for self-hosted
Netbird, so present that alongside direct exposure and note that FortiGate
trusted hosts then has to allow the proxy.
Correct the JSON configuration contract, add FortiGate guide, add navigation
The JSON configuration guide described a schema the trigger engine does not
accept. Corrected against the deserialisation types in
edamame-services/services-core/src/value_objects/access_control/config_file.rs
and the executors that consume them:
- rest and graphql inside add_action / delete_action are arrays, not single
objects. The documented shape panics on deserialisation. auth.rest stays a
single object, which is the one genuine asymmetry.
- The device identifier placeholder is ${ENV.user.deviceId}, not device_id.
An unrecognised attribute name silently interpolates an empty string.
- Documented the attributes that were missing entirely: ipv4, ipv6, username,
peerIds.<key>, and the six ${ENV.internal.*} whole-list placeholders.
- Documented the built-in "internal" action form and the bypass_error /
bypass_certificate flags, including why bypass_error hides real failures.
- Replaced the blanket "case-insensitive" claim on rest_type with the spellings
actually accepted.
New FortiGate guide. The integration has shipped and is offered in Hub, but had
no documentation. It is also the only MAC-based provider, so the L2 adjacency
requirement needed writing down.
NetBird and Tailscale guides gain the device-side prerequisites they were
missing: the provider's client must be installed and connected, and the agent
needs elevation to read the peer identity. Neither failure reports an error, so
without this a stalled rollout has no visible cause. The Tailscale guide also
now states up front that the integration acts on the entire tailnet and will
deauthorize non-compliant devices, including servers and CI runners.
Home was a one-line stub while being the wiki's landing page; it is now an index
with a provider-to-Hub-label mapping, since those names differ. Added _Sidebar
for navigation, and repointed Access-control-Documentation, which the Hub links
to directly, at the index instead of dead-ending.