mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: stop minting the per-hive matrix sender account and token nothing reads

Browse source
This commit is contained in:
damocles 2026-11-12 15:38:34 +01:00
commit c66832febf
2 changed files with 40 additions and 556 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/host-modules/hive-matrix.nix
View file

@ -161,8 +161,8 @@ let
# ── the swarm's own appservice ──────────────────────────────────────
#
# The homeserver's one appservice registration, and the swarm's identity on
# it: `swarm-controller` creates every agent's account and every hive's
# `@hive-<hive>` sender with its token. The store holds its tokens;
# it: `swarm-controller` creates every agent's account with its token. The
# store holds its tokens;
# `swarm-matrix-ctl appservice render` fetches them into this container's
# tmpfs before each homeserver start, and `appservice sync` keeps that copy
# in step with them. Both are gated on matrix-ctl's store identity: with
@ -184,8 +184,9 @@ let
swarmAppserviceLegacyDir = "/var/lib/swarm-matrix-appservice";
swarmAppserviceCredentialId = "swarm-appservice.yaml";
# Every local user the swarm appservice may create — agents and every
# hive's `@hive-<hive>:` sender — which is the whole matrix localpart charset.
# Every local user the swarm appservice may create — agents, and the
# `@hive-<hive>:` senders earlier versions made — which is the whole matrix
# localpart charset.
#
# ⚠️ Anchored deliberately: tuwunel compiles a namespace into a `RegexSet`
# and asks it for a MATCH, not a full match, so an unanchored
@ -1022,10 +1023,8 @@ in
}
# Exactly one account is promoted to homeserver admin at boot:
# the swarm appservice's sender. Its token is read by
# matrix-ctl and swarm-controller only. Each `@hive-<hive>`
# stays an ordinary user, because its hive reads its
# credential; what it does (the invites) rides on its
# power in the room, not on admin.
# matrix-ctl and swarm-controller only. Every other account,
# agents' included, stays an ordinary user.
#
# The registration load creates the sender inside
# `Services::start()`, and `admin_execute` runs after that and

8
nix/host-modules/swarm-bao.nix
View file

@ -382,8 +382,8 @@ let
# instead of rotating it. `metadata/` is the revocation half: `delete` on
# `data/` only soft-deletes the newest version, and `+` being one path segment
# keeps this to the queue leaf alone, and each linked account to its one leaf.
# Each hive's matrix sender token (`matrix_account::hive_sender`) grants `read`
# for the same keep-if-live reason, and `+` for the same glob-only-as-last-segment reason.
# Each hive's forge token (`forge::hive_token`) grants `read` for the same
# keep-if-live reason, and `+` for the same glob-only-as-last-segment reason.
#
# Four leaves it reads and never writes: the swarm appservice token (matrix-ctl),
# its OIDC client secret (the publisher), its forge token (the forge's host)
@ -498,10 +498,6 @@ let
capabilities = ["delete"]
}
path "${credentialMountPath}/data/swarm/hives/+/matrix/sender-token" {
capabilities = ["create", "read", "update"]
}
path "${credentialMountPath}/data/swarm/hives/+/forge/token" {
capabilities = ["create", "read", "update"]
}