vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

docs: clear write-good.Passive hits in docs/networking/snapshot-store.md

Browse source
This commit is contained in:
iris 2026-09-20 13:36:22 +02:00 • committed by mara
commit 02e3fa5afc
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/networking/snapshot-store.md
View file

@ -123,8 +123,8 @@ somebody already thought of.
## Reachability ## Reachability
The receiver is socket-activated, and the socket binds **this host's The receiver is socket-activated, and the socket binds **this host's
mesh address**, never a wildcard. Both the mesh being enabled and the mesh address**, never a wildcard. The module asserts two things: the
address being set are assertions, not documentation --- bound to mesh is on, and the address isn't empty --- neither is just documentation: bound to
`0.0.0.0` this socket is an unauthenticated remote write into agent `0.0.0.0` this socket is an unauthenticated remote write into agent
state. state.
@ -161,7 +161,7 @@ The boundary is the machine. The intended deployments are:
The second is worth keeping deliberately, and not only for The second is worth keeping deliberately, and not only for
convenience: it means every local deployment exercises the confined convenience: it means every local deployment exercises the confined
path. The usual failure mode for an isolated variant is that path. The usual failure mode for an isolated variant is that
nobody runs it day to day, so it rots and is discovered broken in nobody runs it day to day, so it rots and turns up broken in
production. production.
⚠️ **The assumption to keep true over time:** the store host runs ⚠️ **The assumption to keep true over time:** the store host runs
@ -175,8 +175,8 @@ Which makes it the highest-value target in the swarm by a wide margin,
and means it should get the treatment a backup host gets --- restricted and means it should get the treatment a backup host gets --- restricted
access, and a decision (rather than an omission) on encryption at rest. access, and a decision (rather than an omission) on encryption at rest.
The trap is the label: this box holds backup-grade data while not being The trap is the label: this box holds backup-grade data while nobody
called a backup, so it can end up with backup-grade _exposure_ and calls it a backup, so it can end up with backup-grade _exposure_ and
non-backup-grade _controls_. Nobody puts a migration staging area on non-backup-grade _controls_. Nobody puts a migration staging area on
the access-review list. the access-review list.