worklyn / zukapublic
Agent-first git hosting. One Rust binary: git over HTTP and SSH, a REST API, MCP, CI, and multi-tenant isolation.
Get a copy:
git clone https://zuka.worklyn.com/worklyn/zuka.git
ZRequire an operator credential to manage accountszuka · 3 hr ago5ae1edf5
Account creation, listing and deletion on the control plane had no
authentication of any kind. Anyone who could reach the host could enumerate
every tenant, provision containers, and delete accounts along with their
repositories. Putting the host behind a DNS name and a certificate turned
that from a hole into an exposed one; verified against the live host, where
an unauthenticated POST returned 202 and started a container.
The operator is named by ZUKA_OPERATOR and must present an admin-scoped,
unconfined token for that account. With the variable unset every account
endpoint is refused, because the alternative default is what was there.
The rule is a pure function so it can be tested without a control plane, an
Incus host or a token file. The proxy also blocks these paths — the layer
that could be changed in seconds, kept as defence in depth.
Also closes the build-instance gap: a timer restarts it onto a newer binary
once no run is in flight, which is bounded by the CI timeout and so needs no
deferral ceiling.