mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

the operator's bao works on a store host without a hive

Browse source
This commit is contained in:
atlas 2026-11-11 03:09:07 +01:00 • committed by mara
commit 32155f70aa
1 changed files with 169 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/2-handbook/swarm/semi-spread-deploy.md
View file

@ -179,7 +179,13 @@ over the VPN (for a hive, `ca.pem` and the files from
`/var/lib/swarm-bao-pki/hives/<name>/`), then deploy the other machines. The
private keys travel over a channel you trust and stay readable by root only.
[`credentials.md`](credentials.md) lists which leaf each service reads and what
a missing one costs. The first-run steps after the deploys are in
a missing one costs.
On `swarm-central` itself, `bao status`, `bao operator init` and `bao operator
unseal` work as root with no extra step. `swarm-central` runs no hive, so the
`bao` wrapper presents the `operator` leaf that the store's host mints for
itself. That leaf logs in to no role, so every other call still needs a token.
The first-run steps after the deploys are in
[`setup.md`](../../1-getting-started/setup.md).
## DNS