mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarmctl: add bao init and bao grant-bootstrap

Browse source 
init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.
This commit is contained in:
atlas 2026-11-08 01:29:09 +01:00 • committed by mara
commit a20596fa59
1 changed files with 909 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

39
swarmctl/README.md
View file

@ -45,25 +45,42 @@ See `swarm-authelia-bridge/README.md` for what both writers must uphold.
The nix deployment sets every path, each derived from an option it already
has: `swarm-controller.nix` sets the socket, and `glue-controller-env.nix` sets
`SWARMCTL_AUTHELIA_BIN` and `SWARMCTL_AUTHELIA_USERS_FILE`, only where
authelia runs on the same host. They are required
authelia runs on the same host. It also sets
`SWARMCTL_BAO_BOOTSTRAP_TOKEN_FILE` and `SWARMCTL_BAO_BOOTSTRAP_POLICY`, only
where the secret store runs on the same host. They are required
rather than defaulted — a default would be an address we _hope_ points at
something, and one that resolves cleanly to the wrong place is worse than
an error.
| variable | what |
| ------------------------------ | -------------------------------------------------------------------- |
| `SWARMCTL_AUTHELIA_BIN` | the **configured** authelia; argon2 params must match the verifier's |
| `SWARMCTL_AUTHELIA_USERS_FILE` | host-side path of the users database |
| `SWARMCTL_AUTHELIA_MACHINE` | container name, for `systemctl -M` |
| `SWARMCTL_AUTHELIA_UNIT` | authelia's unit inside that container |
| `SWARM_CONTROLLER_SOCKET` | the controller's unix socket, for `agent` and `forge` verbs |
| `SWARMCTL_LOGIN_DEFAULT_SWARM` | `https://<swarm domain>` of this host's swarm, for `login` only |
| `SWARMCTL_SWARM` | the swarm's domain, bare or `https://`: reach the controller there |
| `SWARMCTL_CA_FILE` | a PEM CA to trust beside the system roots, for `SWARMCTL_SWARM` |
| variable | what |
| ----------------------------------- | -------------------------------------------------------------------- |
| `SWARMCTL_AUTHELIA_BIN` | the **configured** authelia; argon2 params must match the verifier's |
| `SWARMCTL_AUTHELIA_USERS_FILE` | host-side path of the users database |
| `SWARMCTL_AUTHELIA_MACHINE` | container name, for `systemctl -M` |
| `SWARMCTL_AUTHELIA_UNIT` | authelia's unit inside that container |
| `SWARMCTL_BAO_BOOTSTRAP_TOKEN_FILE` | where `bao grant-bootstrap` places the 24h grant token |
| `SWARMCTL_BAO_BOOTSTRAP_POLICY` | the `bao-bootstrap` policy file `bao grant-bootstrap` writes |
| `SWARM_CONTROLLER_SOCKET` | the controller's unix socket, for `agent` and `forge` verbs |
| `SWARMCTL_LOGIN_DEFAULT_SWARM` | `https://<swarm domain>` of this host's swarm, for `login` only |
| `SWARMCTL_SWARM` | the swarm's domain, bare or `https://`: reach the controller there |
| `SWARMCTL_CA_FILE` | a PEM CA to trust beside the system roots, for `SWARMCTL_SWARM` |
Every verb and flag: [`docs/2-handbook/swarm/swarmctl-cli.md`](../docs/2-handbook/swarm/swarmctl-cli.md).
The sections below cover why each verb behaves as it does.
## `bao init` and `bao grant-bootstrap`
These run the `bao` CLI, so they reach the store over HTTPS wherever it runs;
the CLI's own `BAO_ADDR`, `BAO_CACERT` and `BAO_CLIENT_*` say where. The root
token is handed to each `bao` child in its own `BAO_TOKEN` environment, which
is readable only by root through `/proc`; it is never in an argument list,
this process's environment or a file, and error text from `bao` has it
replaced before it is shown. `init` prints the keys and the token to stdout
once and keeps none; `grant-bootstrap` reads the token from a hidden prompt,
or from stdin when that is not a terminal. Both wipe the strings from memory
when done, on a best-effort basis: the JSON parser and the pipe buffers touch
the heap on the way.
## `user add`
```console