bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 14:27:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(passwd): also reset The Lounge web-login password (#61)
Some checks failed
CI / build (push) Has been cancelled
Details
deploy / deploy (push) Has been cancelled
Details
test / test (push) Has been cancelled
Details

Browse source 
passwd@ reset the IRC SASL credential (Ergo store + The Lounge saslPassword) but
NOT The Lounge's own web-login password (the bcrypt field used to sign in to
chat.<domain> itself). So a member who reset their password could connect to IRC
but got "auth failed" at chat.profullstack.com/sign-in.

set-irc-password.sh now sets all THREE chat credentials to the new password:
Ergo SASL, the Lounge saslPassword, and the Lounge web-login password via
`thelounge reset <member>` (AGENTBBS_LOUNGE_RESET_CMD, default targets the
dockerized The Lounge). The password is piped on stdin to `thelounge reset`, so
it never lands on a command line. Best-effort: a Lounge web-reset failure warns
but doesn't fail the run (Ergo SASL stays the primary IRC secret).

Bumped ircpass SetPassword's context timeout 20s→60s since the helper now also
runs a `docker exec thelounge ...` step.

Verified live on bbs.profullstack.com: the modified helper sets all three for an
existing member (web bcrypt match + saslPassword + Ergo store), and the affected
member's web login was reconciled.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-27 09:40:28 -07:00 • committed by GitHub
parent 54ede811f9
commit 105ff0ed8a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 72 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

29
docs/credentials.md
View file

@ -45,17 +45,32 @@ password across every service that has its own credential**:
|---|---|---|
| **git** (Forgejo) | admin API — ensure the account, then `SetPassword` (clears `must_change_password`) | git **push** uses the SSH key, not this password; this is for the web UI |
| **mail** (Mailu webmail) | admin API — ensure the mailbox, then `mailu.SetPassword` | the mailbox/IMAP/webmail login |
| **chat** (IRC + The Lounge) | the privileged helper `set-irc-password.sh` via a narrow `sudo` rule | SASL password for native IRC clients **and** the web client; see [`irc.md`](irc.md) |
| **chat** (IRC + The Lounge) | the privileged helper `set-irc-password.sh` via a narrow `sudo` rule | sets all THREE chat credentials to the new password (see below); see [`irc.md`](irc.md) |
BBS/SSH login itself is unaffected — that's always the member's key.
**Chat has three credentials, all set to the new password.** "Chat" spans Ergo
(the IRC server) and The Lounge (the web client at `chat.<domain>`), which between
them keep *three* secrets — `set-irc-password.sh` sets all three so one password
works everywhere:
1. **Ergo SASL** — the pbkdf2 hash in `/var/lib/ergo/irc-passwd` that native IRC
clients (irssi/HexChat) authenticate with.
2. **The Lounge `saslPassword`** — how the *web* client logs in to Ergo on the
member's behalf (in the user's JSON `networks[]`).
3. **The Lounge web-login password** — the bcrypt field used to sign in to
`chat.<domain>` *itself*, set via `thelounge reset <member>`
(`AGENTBBS_LOUNGE_RESET_CMD`). Missing this was the "I reset my password but
chat.profullstack.com says auth failed" bug: a member could reach IRC but not
the web client.
**Why chat needs a helper.** The BBS process runs as the unprivileged `agentbbs`
service user, but the Ergo password store (`/var/lib/ergo/irc-passwd`, `ergo:ergo
0600`) and The Lounge user files are root-owned. `setup.sh` installs
`scripts/set-irc-password.sh` to `/usr/local/sbin/agentbbs-set-irc-password` and a
`/etc/sudoers.d/agentbbs-ircpass` rule letting **only** that one command run as
root. The new password travels on **stdin** (the `set-irc-password.sh <member> -`
form), so it never appears in the process table or sudo's command log. Each leg is
service user, but the Ergo password store (`ergo:ergo 0600`) and The Lounge user
files are root-owned. `setup.sh` installs `scripts/set-irc-password.sh` to
`/usr/local/sbin/agentbbs-set-irc-password` and a `/etc/sudoers.d/agentbbs-ircpass`
rule letting **only** that one command run as root. The new password travels on
**stdin** (the `set-irc-password.sh <member> -` form, and likewise piped to
`thelounge reset`), so it never appears in the process table or sudo's command log. Each leg is
independent: if one service is unconfigured or fails, the others still apply and
the member sees a per-service ✓/✗ summary. A confirmation email (which never
contains the password) is sent on success.