mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

the operator's bao works on a store host without a hive

Browse source
This commit is contained in:
atlas 2026-11-11 03:09:07 +01:00 • committed by mara
commit 32155f70aa
1 changed files with 169 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/1-getting-started/setup.md
View file

@ -99,7 +99,10 @@ and the root token **once**, and stores none of them: not in a file, and the roo
never in a process's argument list (so not in `ps`). Record them off this host before you do
anything else. It refuses an initialised store, and works
from any host that can reach the store and has `bao` on `PATH`; the
wrapper installed on the store host already knows the store's address and CA.
wrapper installed on the store host already knows the store's address and CA, and
presents a client certificate: the hive's own where a hive runs on that host, else
the `operator` leaf that `swarm-bao-pki` mints. Both open the TLS handshake, and
neither logs in to a role.
Then bootstrap the **granter**, the one principal that writes every
`swarm-*` policy and role from then on. This is the only step that needs