mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: stop minting the per-hive matrix sender account and token nothing reads

Browse source
This commit is contained in:
damocles 2026-11-12 15:38:34 +01:00
commit c66832febf
3 changed files with 40 additions and 556 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/host-modules/hive-matrix.nix
View file

@ -161,8 +161,8 @@ let
# ── the swarm's own appservice ──────────────────────────────────────
#
# The homeserver's one appservice registration, and the swarm's identity on
# it: `swarm-controller` creates every agent's account and every hive's
# `@hive-<hive>` sender with its token. The store holds its tokens;
# it: `swarm-controller` creates every agent's account with its token. The
# store holds its tokens;
# `swarm-matrix-ctl appservice render` fetches them into this container's
# tmpfs before each homeserver start, and `appservice sync` keeps that copy
# in step with them. Both are gated on matrix-ctl's store identity: with
@ -184,8 +184,9 @@ let
swarmAppserviceLegacyDir = "/var/lib/swarm-matrix-appservice";
swarmAppserviceCredentialId = "swarm-appservice.yaml";
# Every local user the swarm appservice may create — agents and every
# hive's `@hive-<hive>:` sender — which is the whole matrix localpart charset.
# Every local user the swarm appservice may create — agents, and the
# `@hive-<hive>:` senders earlier versions made — which is the whole matrix
# localpart charset.
#
# ⚠️ Anchored deliberately: tuwunel compiles a namespace into a `RegexSet`
# and asks it for a MATCH, not a full match, so an unanchored
@ -1022,10 +1023,8 @@ in
}
# Exactly one account is promoted to homeserver admin at boot:
# the swarm appservice's sender. Its token is read by
# matrix-ctl and swarm-controller only. Each `@hive-<hive>`
# stays an ordinary user, because its hive reads its
# credential; what it does (the invites) rides on its
# power in the room, not on admin.
# matrix-ctl and swarm-controller only. Every other account,
# agents' included, stays an ordinary user.
#
# The registration load creates the sender inside
# `Services::start()`, and `admin_execute` runs after that and

8
nix/host-modules/swarm-bao.nix
View file

@ -382,8 +382,8 @@ let
# instead of rotating it. `metadata/` is the revocation half: `delete` on
# `data/` only soft-deletes the newest version, and `+` being one path segment
# keeps this to the queue leaf alone, and each linked account to its one leaf.
# Each hive's matrix sender token (`matrix_account::hive_sender`) grants `read`
# for the same keep-if-live reason, and `+` for the same glob-only-as-last-segment reason.
# Each hive's forge token (`forge::hive_token`) grants `read` for the same
# keep-if-live reason, and `+` for the same glob-only-as-last-segment reason.
#
# Four leaves it reads and never writes: the swarm appservice token (matrix-ctl),
# its OIDC client secret (the publisher), its forge token (the forge's host)
@ -498,10 +498,6 @@ let
capabilities = ["delete"]
}
path "${credentialMountPath}/data/swarm/hives/+/matrix/sender-token" {
capabilities = ["create", "read", "update"]
}
path "${credentialMountPath}/data/swarm/hives/+/forge/token" {
capabilities = ["create", "read", "update"]
}

10
nix/module-eval/bao-grants.nix
View file

@ -1862,21 +1862,19 @@ let
covers "hive-hives" && covers "hive-agent" && !(covers "swarm-hives");
}
{
# `matrix_account::hive_sender` writes every hive's sender token and
# `forge::hive_token` every hive's forge token, and nothing else under
# `hives/`, where each hive's queue credential also lives. `proxy_credential`
# `forge::hive_token` writes every hive's forge token, and nothing else
# under `hives/`, where each hive's queue credential also lives. `proxy_credential`
# creates each hive's squid self-check credential and reads it back, and
# has no `update`, so it cannot replace one. `+` is one
# segment, which keeps each stanza to its one leaf; a `*` is a glob only
# at the end of a path. Pinned as whole stanzas, so an added capability
# fails.
name = "the controller writes each hive's sender and forge tokens, creates its squid self-check credential, manages its archive grants, and nothing else under hives";
name = "the controller writes each hive's forge token, creates its squid self-check credential, manages its archive grants, and nothing else under hives";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
in
lib.hasInfix "path \"secret/data/swarm/hives/+/matrix/sender-token\" {\n capabilities = [\"create\", \"read\", \"update\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/hives/+/forge/token\" {\n capabilities = [\"create\", \"read\", \"update\"]\n}" s
lib.hasInfix "path \"secret/data/swarm/hives/+/forge/token\" {\n capabilities = [\"create\", \"read\", \"update\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/hives/+/squid-selfcheck\" {\n capabilities = [\"create\", \"read\"]\n}" s
&& !(lib.hasInfix "secret/data/swarm/hives/*" s)
# The only metadata it reaches under hives is the archive grants: list and delete.