mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarmctl: add bao init and bao grant-bootstrap

Browse source 
init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.
This commit is contained in:
atlas 2026-11-08 01:29:09 +01:00 • committed by mara
commit a20596fa59
1 changed files with 909 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/module-eval/core-toggle.nix
View file

@ -280,16 +280,22 @@ let
}
{
# Same file: `swarmctl` is told where the configured authelia is only
# where authelia runs here.
name = "swarmctl is given the authelia binary and users file only where authelia runs here";
# where authelia runs here, and where the bao bootstrap token and policy
# go only where the store runs here. `controllerAlone` runs neither, so
# it is the control that an entry is absent when its service is.
name = "swarmctl is given the authelia and bao-bootstrap coordinates only where those run here";
ok =
let
env = m: m.services.hyperhive.deploy.swarm-controller.swarmctlEnvironment;
d = allLocal.services.hyperhive.deploy.authelia;
b = allLocal.services.hyperhive.deploy.bao;
in
env allLocal == {
SWARMCTL_AUTHELIA_BIN = "${d.package}/bin/authelia";
SWARMCTL_AUTHELIA_USERS_FILE = d.hostUsersFile;
SWARMCTL_BAO_BOOTSTRAP_TOKEN_FILE = b.bootstrapTokenFile;
SWARMCTL_BAO_BOOTSTRAP_POLICY = "${allLocal.environment.etc."hyperhive/bao-bootstrap-policy.hcl".source
}";
}
&& env shared.controllerAlone == { };
}