vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

give cert-auth role tokens a 15m ttl so logins stop leaving 32-day leases

Browse source
This commit is contained in:
atlas 2026-10-28 18:32:44 +01:00 • committed by mara
commit 00df3ccffb
1 changed files with 160 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/swarm/credentials.md
View file

@ -454,8 +454,21 @@ The roles of `swarm-nats-auth`, `swarm-logs-auth` and `swarm-metrics-auth` issue
batch tokens with a five-minute TTL (`token_type=batch`, `token_ttl=5m`). The
responders log in on every check, and the store keeps no record of a batch token,
so unauthenticated requests don't grow its token storage. Nothing can renew
or revoke a batch token. The other roles keep service tokens, because some of
their readers hold a handle for longer than five minutes.
or revoke a batch token.
The other roles issue service tokens that live 15 minutes (`token_ttl=15m` and
`token_max_ttl=15m`). That covers the roles `swarm-bao.nix` writes, and the
agent and hive roles the controller writes through
`SecretStore::write_cert_role`, which takes the same value from
`CERT_ROLE_TOKEN_TTL`. The store keeps a lease for every token until it
expires, and the mount default of 32 days leaves one lease per login for a
month; at the 17 thousand logins a day this swarm made, that came to half a
million leases. A reader logs in per operation and holds the token for seconds.
The longest hold is the controller's forge work, which stops after two minutes.
A client that keeps a `SecretStore` handle longer than 15 minutes must log in
again, because nothing renews the token. A role the controller writes takes the
TTL at its next write: a hive's at the controller's start, an agent's at its
next certificate renewal.
### What a missing leaf costs