From 4d9b7e0ca93d9d9a7bde19e6ebfb87f0b94950bf Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Sun, 25 Oct 2026 01:55:59 +0200
Subject: [PATCH] agent store leaf: 7 days instead of 90

---
 docs/swarm/credentials.md             | 2 +-
 nix/host-modules/swarm-bao.nix        | 2 +-
 nix/module-eval/bao-grants.nix        | 4 ++--
 swarm-controller/src/agent_renewal.rs | 8 ++++----
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/docs/swarm/credentials.md b/docs/swarm/credentials.md
index 65125a37..889d62cf 100644
--- a/docs/swarm/credentials.md
+++ b/docs/swarm/credentials.md
@@ -35,7 +35,7 @@ the rest of the cell says how.
 | `swarm/controller/swarm-controller/oidc/client`             | authelia, first boot                                                                 | `swarm-controller`                                  | ❌ minted once; `swarm-secret-publish` republishes a re-mint                                                   | ✅ re-read when authelia refuses it                                                                                                                                                                                                                          |
 | `swarm/controller/swarm-controller/forge/token`             | the forge, once                                                                      | `swarm-controller`                                  | ❌ minted once; delete `/var/lib/forgejo/swarm-controller-token-name` in the forge container to mint a new one | ✅ re-read on a 401                                                                                                                                                                                                                                          |
 | `swarm/controller/swarm-controller/grafana/token`           | `swarm-bao-grafana-controller-token` on Grafana's host                               | `swarm-controller`                                  | ✅ every 10 minutes, when Grafana refuses it or none is stored                                                 | ✅ re-read on a 401                                                                                                                                                                                                                                          |
-| `swarm/agents/<agent>/bao-mtls`                             | the store's agent PKI mount (`deploy.bao.agentPkiMountPath`), at agent creation      | `hive-c0re`, then the agent                         | ✅ re-issued every 5 minutes once past half its 90-day validity                                                | ✅ the agent re-reads every 10 minutes; it renews only while its current leaf is valid                                                                                                                                                                       |
+| `swarm/agents/<agent>/bao-mtls`                             | the store's agent PKI mount (`deploy.bao.agentPkiMountPath`), at agent creation      | `hive-c0re`, then the agent                         | ✅ re-issued every 5 minutes once past half its 7-day validity                                                 | ✅ the agent re-reads every 10 minutes; it renews only while its current leaf is valid                                                                                                                                                                       |
 | `swarm/agents/<agent>/queue`                                | `swarm-controller`, at agent creation                                                | the agent; the queue, log and metrics auth services | ✅ re-minted at 45 days; skipped for `Destroyed` agents, whose path is deleted                                 | ✅ read on every reconnect; an open connection keeps the old secret for up to an hour; the log and metrics stores honour a replaced secret for up to `deploy.victorialogs.authVerdictTtl` and `deploy.victoriametrics.agentAuthVerdictTtl` (60 s by default) |
 | `swarm/agents/<agent>/forge-token`                          | `swarm-controller`, at agent creation and every 5 minutes                            | the agent                                           | ✅ when missing or no longer matching the forge                                                                | ✅ every 10 minutes                                                                                                                                                                                                                                          |
 | `swarm/agents/<agent>/forge/<label>`                        | `swarm-controller`, when you link an external forge account in the swarm UI          | the agent                                           | ❌ your token; delete it and link the label again                                                              | ✅ every 2 minutes                                                                                                                                                                                                                                           |
diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 49a46277..aaf45572 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -839,7 +839,7 @@ let
 
   # The agent leaf's window, pinned on the role. `swarm-controller` re-issues a
   # live agent's leaf once it is past half of it (`agent_renewal.rs`).
-  agentPkiLeafTtl = "2160h";
+  agentPkiLeafTtl = "168h";
 
   # The agent CA's certificate, cached on this host by `swarm-bao-agent-pki`,
   # so `swarm-bao-certs` can compose the listener's bundle before the store
diff --git a/nix/module-eval/bao-grants.nix b/nix/module-eval/bao-grants.nix
index ac85b004..a6e7b314 100644
--- a/nix/module-eval/bao-grants.nix
+++ b/nix/module-eval/bao-grants.nix
@@ -2246,8 +2246,8 @@ let
           "client_flag=true"
           "code_signing_flag=false"
           "email_protection_flag=false"
-          "ttl=2160h"
-          "max_ttl=2160h"
+          "ttl=168h"
+          "max_ttl=168h"
         ]
         && lib.length roleWriters == 1;
     }
diff --git a/swarm-controller/src/agent_renewal.rs b/swarm-controller/src/agent_renewal.rs
index bb0f6b5f..56d70dec 100644
--- a/swarm-controller/src/agent_renewal.rs
+++ b/swarm-controller/src/agent_renewal.rs
@@ -39,9 +39,9 @@ use x509_cert::der::DecodePem as _;
 
 use crate::wanted::WantedWriter;
 
-/// Age at which a queue secret is re-minted: half the agent certificate's
-/// 90-day life (`agentPkiLeafTtl` in `swarm-bao.nix`), so the two renew on one
-/// cadence.
+/// Age at which a queue secret is re-minted. Independent of the agent
+/// certificate's life (`agentPkiLeafTtl` in `swarm-bao.nix`), which renews at
+/// half its own validity.
 pub const SECRET_RENEW_AFTER: std::time::Duration = std::time::Duration::from_hours(45 * 24);
 
 /// How often [`spawn`] re-checks every agent. Also the longest it waits for
@@ -435,7 +435,7 @@ mod tests {
     const DAY: i64 = 86_400;
 
     /// Self-signed, CN `hive-agent-atlas`, valid 2026-01-01T00:00:00Z to
-    /// 2026-04-01T00:00:00Z: 90 days, the agent role's `ttl`. Its key was
+    /// 2026-04-01T00:00:00Z: 90 days, a window the agent role no longer issues. Its key was
     /// discarded.
     const CERT_PEM: &str = "-----BEGIN CERTIFICATE-----
 MIIBizCCATGgAwIBAgIUSFpuYmy1UoHvq/MYiyrAudRaWXcwCgYIKoZIzj0EAwIw