vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

give cert-auth role tokens a 15m ttl so logins stop leaving 32-day leases

Browse source
This commit is contained in:
atlas 2026-10-28 18:32:44 +01:00 • committed by mara
commit 00df3ccffb
1 changed files with 160 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

42
nix/host-modules/swarm-bao.nix
View file

@ -988,6 +988,15 @@ let
# live agent's leaf once it is past half of it (`agent_renewal.rs`).
agentPkiLeafTtl = "168h";
# Lifetime of a token from a cert login, on every cert-auth role this file
# writes except the batch ones. The store keeps a lease per token until it
# expires; a login per operation at the mount default (32 days) leaves one
# lease each for a month. Every holder logs in, works and drops the token
# within two minutes (the controller's forge work is cut off at
# `FORGE_DEADLINE`). Rust-written roles take `CERT_ROLE_TOKEN_TTL`, which
# is the same value.
certRoleTokenTtl = "15m";
# The agent CA's certificate, cached on this host by `swarm-bao-agent-pki`,
# so `swarm-bao-certs` can compose the listener's bundle before the store
# is up. Public material.
@ -1372,15 +1381,18 @@ let
readerRoleWrite =
obj:
let
batchArgs = lib.optionalString (obj.batchToken or false
) " \\\n token_type=batch \\\n token_ttl=5m";
ttlArgs =
if obj.batchToken or false then
" \\\n token_type=batch \\\n token_ttl=5m"
else
" \\\n token_ttl=${certRoleTokenTtl} \\\n token_max_ttl=${certRoleTokenTtl}";
in
''
bao write auth/cert/certs/${lib.escapeShellArg obj.name} \
certificate=@${tlsDir}/client-ca.pem \
allowed_common_names=${lib.escapeShellArg obj.cn} \
token_policies=${lib.escapeShellArg obj.name} \
display_name=${lib.escapeShellArg obj.cn}${batchArgs}
display_name=${lib.escapeShellArg obj.cn}${ttlArgs}
'';
# A unit that logs in as the granter and runs `body`, ordered after the
@ -3660,7 +3672,9 @@ in
certificate=@${tlsDir}/client-ca.pem \
allowed_common_names=${lib.escapeShellArg controllerCn} \
token_policies=${lib.escapeShellArg controllerPolicyName} \
display_name=${lib.escapeShellArg controllerCn}
display_name=${lib.escapeShellArg controllerCn} \
token_ttl=${certRoleTokenTtl} \
token_max_ttl=${certRoleTokenTtl}
'';
};
@ -3684,7 +3698,9 @@ in
certificate=@${tlsDir}/client-ca.pem \
allowed_common_names=${lib.escapeShellArg secretPublisherCn} \
token_policies=${lib.escapeShellArg secretPublisherPolicyName} \
display_name=${lib.escapeShellArg secretPublisherCn}
display_name=${lib.escapeShellArg secretPublisherCn} \
token_ttl=${certRoleTokenTtl} \
token_max_ttl=${certRoleTokenTtl}
'';
# A THIRD sibling, for the reason the second one's comment gives: these
@ -3703,7 +3719,9 @@ in
certificate=@${tlsDir}/client-ca.pem \
allowed_common_names=${lib.escapeShellArg matrixCtlCn} \
token_policies=${lib.escapeShellArg matrixCtlPolicyName} \
display_name=${lib.escapeShellArg matrixCtlCn}
display_name=${lib.escapeShellArg matrixCtlCn} \
token_ttl=${certRoleTokenTtl} \
token_max_ttl=${certRoleTokenTtl}
'';
# 🩸 The principals that each log in with a leaf of their own, not as the
@ -3757,7 +3775,9 @@ in
certificate=@${tlsDir}/client-ca.pem \
allowed_common_names=${lib.escapeShellArg servicesIssuerCn} \
token_policies=${lib.escapeShellArg servicesIssuerPolicyName} \
display_name=${lib.escapeShellArg servicesIssuerCn}
display_name=${lib.escapeShellArg servicesIssuerCn} \
token_ttl=${certRoleTokenTtl} \
token_max_ttl=${certRoleTokenTtl}
'';
# A FIFTH sibling: the queue's issuing role, its policy and its login
@ -3793,7 +3813,9 @@ in
certificate=@${tlsDir}/client-ca.pem \
allowed_common_names=${lib.escapeShellArg natsCn} \
token_policies=${lib.escapeShellArg natsPolicyName} \
display_name=${lib.escapeShellArg natsCn}
display_name=${lib.escapeShellArg natsCn} \
token_ttl=${certRoleTokenTtl} \
token_max_ttl=${certRoleTokenTtl}
'';
# A SIXTH sibling, the nats unit's shape once per hive: each hive's
@ -3829,7 +3851,9 @@ in
certificate=@${tlsDir}/client-ca.pem \
allowed_common_names=${lib.escapeShellArg obj.cn} \
token_policies=${lib.escapeShellArg obj.name} \
display_name=${lib.escapeShellArg obj.cn}
display_name=${lib.escapeShellArg obj.cn} \
token_ttl=${certRoleTokenTtl} \
token_max_ttl=${certRoleTokenTtl}
'') hiveLeafIssuers
);