vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: link the secrets page from setup, fix a dropped word

Browse source 
Per mara: setup should point at it. The link is placed as a precondition
rather than a see-also -- every step below assumes each credential is
generated where it is read, which is only true all-local.

Per argus: 'with a bound' was missing a word; it now names the actual
120s wait instead of gesturing at one.
This commit is contained in:
atlas 2026-08-14 12:07:34 +02:00 • committed by mara
commit 10b2862ad2
2 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/setup.md
View file

@ -10,6 +10,12 @@ sequence. All `hivectl` commands below run as **root on the host** (not
inside an agent container); the `request_*` steps run from ruth's own
turn via the MCP tools.
**Bringing up a hive that does not host its own swarm services?** Read
[`swarm/secrets.md`](swarm/secrets.md) first. Everything below assumes
each credential is generated where it is read, which is true on an
all-local deploy and not otherwise — that page says which files an
operator has to place, and where.
## Step-by-step
### 1 · Forge

7
docs/swarm/secrets.md
View file

@ -60,9 +60,10 @@ the one row that fails it, which is the entire reason a delivery step exists.
| the forge's copy of its OIDC secret | `hive-forge-oidc-secret.service` copies it from authelia's tree | `/var/lib/forgejo-oidc/<id>.secret` inside the forge container |
| the homeserver's copy of its OIDC secret | `hive-matrix-oidc-secret.service`, same shape | `/var/lib/tuwunel-oidc/<id>.secret`, handed to tuwunel through `LoadCredential` |
Both delivery units wait for authelia's first boot to mint the secret, with a
bound, and **fail loudly** rather than skipping. A silent skip produces a service
whose login button always fails — a symptom several layers from its cause.
Both delivery units wait for authelia's first boot to mint the secret — a
bounded wait, 120s — and then **fail loudly** rather than skipping. A silent skip
produces a service whose login button always fails, which is a symptom several
layers from its cause.
## The constraint that decides where the root lives