vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: drop the stale claim that authelia mints hive-<name>-agent

Browse source
This commit is contained in:
atlas 2026-10-13 10:16:30 +02:00 • committed by mara
commit 495c45c2c2
6 changed files with 23 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

17
swarm-nats-auth/src/main.rs
View file

@ -125,15 +125,10 @@ struct Args {
#[arg(long, default_value = "hive-")]
hive_client_prefix: String,
/// Suffix that marks an agent container, appended to the hive's own client
/// id: `swarm-authelia.nix` mints one machine client per roster entry as
/// `hive-<name>-agent` — per **hive**, not per agent, because agents are
/// created at runtime and a per-agent client would make creating one a
/// config change plus a reload.
///
/// So this identity says which hive an agent belongs to and never which
/// agent: two agents on one hive are indistinguishable under it. The
/// responder refuses it; the suffix is what tells it apart from a hive.
/// Suffix appended to a hive's own client id: `hive-<name>-agent`. No
/// client is minted with it — agents authenticate with their own secret —
/// so the responder refuses it; the suffix is what tells such an id apart
/// from the hive `<name>-agent`.
///
/// A suffix on the hive's id rather than a prefix of its own, because
/// `agent-<name>` reads as *the agent called `<name>`* — the one thing
@ -413,8 +408,8 @@ impl<S: swarm_agent_verify::CredentialSource> Responder<S> {
};
// The caller is an identifier, not a credential: a client id, or
// `agent:<name>` for an agent token. One line per auth request, a connect
// or a reconnect, so `hive-<h>-agent` lines count requests made on a
// hive's shared credential, not agents.
// or a reconnect, so a `hive-<h>` line counts requests made on
// a hive's own credential.
tracing::info!(
user_nkey = %req.user_nkey,
server_id = %req.server_id.id,

2
swarm-nats-auth/src/policy.rs
View file

@ -63,7 +63,7 @@ const AGENT_PLACEHOLDER: &str = "{agent}";
impl Policy {
/// `hive_prefix` is the client-id prefix that marks a hive and
/// `agent_suffix` what a hive's agent containers carry **on top of** it —
/// `agent_suffix` the suffix the responder refuses **on top of** it —
/// `hive-<name>` and `hive-<name>-agent`. `bucket` is the KV bucket hives
/// report status in, `readers` the client ids allowed to read every hive's
/// key, and `extra_hive_subjects` additional subjects a hive may publish to