https://alwaldend.com/tags/t3code/ Recent content in T3code on Alwaldend Hugo en https://alwaldend.com/docs/users/simeonwarren/host_bot/ Mon, 01 Jan 0001 00:00:00 +0000 https://alwaldend.com/docs/users/simeonwarren/host_bot/ <p>Host Bot runs Traefik with mTLS in front of T3 Code. The host firewall blocks direct external access to T3 Code and accepts new connections only on SSH, HTTP, and HTTPS ports.</p> <p>T3 Code controls permissions per thread. Its <strong>Auto</strong> mode maps to Codex Auto-review. The managed Codex requirements allow read-only and <code>host-bot</code> permissions with on-request approvals, so threads cannot select <strong>Full access</strong> or disable approvals. The requirements file only allowlists the <code>host-bot</code> profile; it must not define the profile because T3 Code supplies a per-thread config layer with the same name, and Codex rejects profiles defined by both requirements and config. The normal and isolated provider configs define <code>host-bot</code> with workspace writes, public command-network access, and write access to the Bazel cache and Bazelisk directories while keeping local network binding and loopback connections available for Bazel servers. Other private network targets remain blocked. T3 Code must select that profile for the thread. Hosted web search is not restricted by this role.</p>