vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-forge: the controller-token mint writes straight to the store, and the on-disk token goes

Browse source 
`forgejo-swarm-controller-account`, in the forge's container, now puts
the swarm-controller's forge token into the swarm secret store itself,
under the forge publisher's leaf. The container already receives that
leaf as nspawn system credentials for its journal forwarder; the mint
loads the same three. The token reaches bao on stdin (`value=-`) and
the forge's API through a header file, never as an argument, and never
touches disk.

The mint's guard is a marker holding the published token's name, at
/var/lib/forgejo/swarm-controller-token-name, written last: after the
put, and after every other `swarm-controller-boot-*` token of the
account is revoked through forgejo's admin API, authenticated as the
new token. So a put that failed, or a marker lost while the store kept
an older token, leaves no live token behind once a mint completes. The
mint logs in to the store and checks that the account is a site admin
before it mints, so a store that is down or an account the admin API
would refuse mints nothing on each retry. Failures retry under
store-retry; forgejo does not wait for the mint. No bao read and no
grant change: the forge publisher keeps create/update on the token.

Removed: the host's `swarm-bao-forge-publisher` service and path unit,
which read the token file through the container's root, and their
entries in the store and policy ordering glue. The forge publisher's
policy unit stays; `swarm-bao-forge-oidc` still uses the leaf.

On deploy, an existing forge host has no marker, so the mint runs once:
it mints a new token, publishes it, revokes the old one, and deletes
the old /var/lib/forgejo/swarm-controller-token. The controller's next
forge call gets a 401, re-reads the store and carries on.
This commit is contained in:
atlas 2026-10-16 14:39:19 +02:00 • committed by mara
commit 141be16c6d
14 changed files with 294 additions and 261 deletions
Download patch file Download diff file Expand all files Collapse all files

12
swarm-secret-client/src/forge.rs
View file

@ -14,8 +14,8 @@
//! beside [`crate::matrix`].
//!
//! `swarm-controller`'s own forge token ([`controller_token_path`]) is the
//! fourth: the forge mints it, `swarm-bao-forge-publisher` on the forge's host
//! writes it here, and the controller reads it as it starts.
//! fourth: the forge's `forgejo-swarm-controller-account`, in its container,
//! mints it and writes it here, and the controller reads it as it starts.
use serde::{Deserialize, Serialize};
@ -82,14 +82,14 @@ pub fn controller_token_path() -> Result<String, Error> {
}
/// What [`controller_token_path`] holds. No token name beside the value, unlike
/// [`Credential`]: the publisher copies a file that holds the token alone.
/// [`Credential`]: the mint writes the token alone.
///
/// No `Debug` derive: `value` is the forge admin credential.
#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ControllerToken {
/// The token itself. `swarm-bao-forge-publisher` writes it with
/// `bao kv put … value=@<file>`, so this name is load-bearing for a writer
/// this crate does not control.
/// The token itself. `forgejo-swarm-controller-account` writes it with
/// `bao kv put … value=-`, so this name is load-bearing for a writer this
/// crate does not control.
pub value: String,
}