mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

semi-spread example: name the store's CA on the machines without the store

Browse source
This commit is contained in:
atlas 2026-11-10 18:36:40 +01:00 • committed by mara
commit 250118d558
1 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/2-handbook/swarm/semi-spread-deploy.md
View file

@ -170,10 +170,12 @@ addresses for you, so the key steps above go away. Three things change:
## Reading the store
Only `swarm-central` runs the secret store, and every service on the other
machines reads it with a client certificate that the store's host mints. The
example names each leaf under `/var/lib/swarm-pki/` on the machine that uses
it. After the first deploy of `swarm-central`, copy the files from
`/var/lib/swarm-bao-pki/` there over the VPN (for a hive, from
machines reads it with a client certificate that the store's host mints, and
checks the store against its CA (`ca.pem`). The example names each leaf, and
`ca.pem`, under `/var/lib/swarm-pki/` on the machine that uses it. Without
`ca.pem` the machines don't trust the store's certificate. After the first
deploy of `swarm-central`, copy the files from `/var/lib/swarm-bao-pki/` there
over the VPN (for a hive, `ca.pem` and the files from
`/var/lib/swarm-bao-pki/hives/<name>/`), then deploy the other machines. The
private keys travel over a channel you trust and stay readable by root only.
[`credentials.md`](credentials.md) lists which leaf each service reads and what