mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

attic-init: replace the stored public key with the one the cache reports

Browse source 
a re-created cache signs with a new key; the fact was only created once, so
every hive then rejected the swarm's closures. the cache's grant gains update
on that one leaf, and a store that refuses it leaves the key as it was.

Closes #6181
This commit is contained in:
atlas 2026-11-07 07:32:28 +01:00 • committed by mara
commit b0f6ccaa64
1 changed files with 159 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/4-implementation/swarm/builder.md
View file

@ -419,10 +419,13 @@ mints nothing. Both tokens last ten years and nothing renews them. To replace on
write the new token to its path in the store, in its UI under the OIDC login:
nothing mints over a value that exists. A new signing key invalidates both tokens.
The unit creates the address, name and key once and never updates them. After
you change `swarm.attic.domain`, or after the server's database goes and the
cache gets a new key, delete the stale leaf and restart
`swarm-bao-attic-tokens`.
The unit creates the address and the name once and never updates them. After
you change `swarm.attic.domain`, delete the stale `url` leaf and restart
`swarm-bao-attic-tokens`. The unit checks the public key on every run and
replaces the stored one with the key `attic cache info` prints, so a cache
that loses its database and gets a new key needs no step: the next run of the
unit stores the new key, the controller copies it to the hives within five
minutes, and `hive-priv-cache-facts` reads it within ten.
`swarm.attic.domain` and `swarm.attic.cache` default to `attic.<swarm domain>`
and `swarm` on every host, whether or not it runs the cache, so a builder on any