mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-archive: grant only once an archive is up; keep logins across a gap in placements

Browse source 
The archive host creates a ready marker in the store and swarm-controller
writes no credentials before it exists, so a swarm without an archive, and a
mixed-version swarm, leave every hive backup a logged no-op. A hive with no
declaration no longer counts as placing nothing: its copies and its agents'
user lines stay. The restic password is pinned by tests across a revoke, a
re-placement and a move.
This commit is contained in:
atlas 2026-11-10 08:18:45 +01:00
commit 91f36f39d2
1 changed files with 241 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/module-eval/bao-grants.nix
View file

@ -2171,7 +2171,7 @@ let
# The archive reads the users and the repositories' passwords and writes
# nothing; the hive-side copies of the REST password are not its to read.
# The controller is the only writer: the control is its own grant.
name = "the archive's grant is read on its users and restic passwords, list on its users, and nothing else, and only the controller writes them";
name = "the archive's grant is read on its users and restic passwords, list on its users, create and read on its ready marker, and nothing else, and only the controller writes them";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-archive-policy.script;
@ -2181,8 +2181,14 @@ let
(grantFor grants "secret/data/swarm/services/archive/users/atlas").caps == [ "read" ]
&& (grantFor grants "secret/data/swarm/services/archive/restic/atlas").caps == [ "read" ]
&& (grantFor grants "secret/metadata/swarm/services/archive/users/").caps == [ "list" ]
&&
(grantFor grants "secret/data/swarm/services/archive/ready").caps == [
"create"
"read"
]
&& (grantFor c "secret/data/swarm/services/archive/ready").caps == [ "read" ]
&& grantFor grants "secret/data/swarm/hives/h1/archive/atlas" == null
&& lib.length grants == 3
&& lib.length grants == 4
&& lib.hasInfix "allowed_common_names=swarm-archive" s
&& lib.hasInfix "token_policies=swarm-archive" s
&& lib.elem "create" (grantFor c "secret/data/swarm/services/archive/users/atlas").caps