vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agent store leaf: 7 days instead of 90

Browse source
This commit is contained in:
atlas 2026-10-25 01:55:59 +02:00
commit 4d9b7e0ca9
4 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/swarm/credentials.md
View file

@ -35,7 +35,7 @@ the rest of the cell says how.
| `swarm/controller/swarm-controller/oidc/client` | authelia, first boot | `swarm-controller` | ❌ minted once; `swarm-secret-publish` republishes a re-mint | ✅ re-read when authelia refuses it | | `swarm/controller/swarm-controller/oidc/client` | authelia, first boot | `swarm-controller` | ❌ minted once; `swarm-secret-publish` republishes a re-mint | ✅ re-read when authelia refuses it |
| `swarm/controller/swarm-controller/forge/token` | the forge, once | `swarm-controller` | ❌ minted once; delete `/var/lib/forgejo/swarm-controller-token-name` in the forge container to mint a new one | ✅ re-read on a 401 | | `swarm/controller/swarm-controller/forge/token` | the forge, once | `swarm-controller` | ❌ minted once; delete `/var/lib/forgejo/swarm-controller-token-name` in the forge container to mint a new one | ✅ re-read on a 401 |
| `swarm/controller/swarm-controller/grafana/token` | `swarm-bao-grafana-controller-token` on Grafana's host | `swarm-controller` | ✅ every 10 minutes, when Grafana refuses it or none is stored | ✅ re-read on a 401 | | `swarm/controller/swarm-controller/grafana/token` | `swarm-bao-grafana-controller-token` on Grafana's host | `swarm-controller` | ✅ every 10 minutes, when Grafana refuses it or none is stored | ✅ re-read on a 401 |
| `swarm/agents/<agent>/bao-mtls` | the store's agent PKI mount (`deploy.bao.agentPkiMountPath`), at agent creation | `hive-c0re`, then the agent | ✅ re-issued every 5 minutes once past half its 90-day validity | ✅ the agent re-reads every 10 minutes; it renews only while its current leaf is valid | | `swarm/agents/<agent>/bao-mtls` | the store's agent PKI mount (`deploy.bao.agentPkiMountPath`), at agent creation | `hive-c0re`, then the agent | ✅ re-issued every 5 minutes once past half its 7-day validity | ✅ the agent re-reads every 10 minutes; it renews only while its current leaf is valid |
| `swarm/agents/<agent>/queue` | `swarm-controller`, at agent creation | the agent; the queue, log and metrics auth services | ✅ re-minted at 45 days; skipped for `Destroyed` agents, whose path is deleted | ✅ read on every reconnect; an open connection keeps the old secret for up to an hour; the log and metrics stores honour a replaced secret for up to `deploy.victorialogs.authVerdictTtl` and `deploy.victoriametrics.agentAuthVerdictTtl` (60 s by default) | | `swarm/agents/<agent>/queue` | `swarm-controller`, at agent creation | the agent; the queue, log and metrics auth services | ✅ re-minted at 45 days; skipped for `Destroyed` agents, whose path is deleted | ✅ read on every reconnect; an open connection keeps the old secret for up to an hour; the log and metrics stores honour a replaced secret for up to `deploy.victorialogs.authVerdictTtl` and `deploy.victoriametrics.agentAuthVerdictTtl` (60 s by default) |
| `swarm/agents/<agent>/forge-token` | `swarm-controller`, at agent creation and every 5 minutes | the agent | ✅ when missing or no longer matching the forge | ✅ every 10 minutes | | `swarm/agents/<agent>/forge-token` | `swarm-controller`, at agent creation and every 5 minutes | the agent | ✅ when missing or no longer matching the forge | ✅ every 10 minutes |
| `swarm/agents/<agent>/forge/<label>` | `swarm-controller`, when you link an external forge account in the swarm UI | the agent | ❌ your token; delete it and link the label again | ✅ every 2 minutes | | `swarm/agents/<agent>/forge/<label>` | `swarm-controller`, when you link an external forge account in the swarm UI | the agent | ❌ your token; delete it and link the label again | ✅ every 2 minutes |

2
nix/host-modules/swarm-bao.nix
View file

@ -839,7 +839,7 @@ let
# The agent leaf's window, pinned on the role. `swarm-controller` re-issues a # The agent leaf's window, pinned on the role. `swarm-controller` re-issues a
# live agent's leaf once it is past half of it (`agent_renewal.rs`). # live agent's leaf once it is past half of it (`agent_renewal.rs`).
agentPkiLeafTtl = "2160h"; agentPkiLeafTtl = "168h";
# The agent CA's certificate, cached on this host by `swarm-bao-agent-pki`, # The agent CA's certificate, cached on this host by `swarm-bao-agent-pki`,
# so `swarm-bao-certs` can compose the listener's bundle before the store # so `swarm-bao-certs` can compose the listener's bundle before the store

4
nix/module-eval/bao-grants.nix
View file

@ -2246,8 +2246,8 @@ let
"client_flag=true" "client_flag=true"
"code_signing_flag=false" "code_signing_flag=false"
"email_protection_flag=false" "email_protection_flag=false"
"ttl=2160h" "ttl=168h"
"max_ttl=2160h" "max_ttl=168h"
] ]
&& lib.length roleWriters == 1; && lib.length roleWriters == 1;
} }

8
swarm-controller/src/agent_renewal.rs
View file

@ -39,9 +39,9 @@ use x509_cert::der::DecodePem as _;
use crate::wanted::WantedWriter; use crate::wanted::WantedWriter;
/// Age at which a queue secret is re-minted: half the agent certificate's /// Age at which a queue secret is re-minted. Independent of the agent
/// 90-day life (`agentPkiLeafTtl` in `swarm-bao.nix`), so the two renew on one /// certificate's life (`agentPkiLeafTtl` in `swarm-bao.nix`), which renews at
/// cadence. /// half its own validity.
pub const SECRET_RENEW_AFTER: std::time::Duration = std::time::Duration::from_hours(45 * 24); pub const SECRET_RENEW_AFTER: std::time::Duration = std::time::Duration::from_hours(45 * 24);
/// How often [`spawn`] re-checks every agent. Also the longest it waits for /// How often [`spawn`] re-checks every agent. Also the longest it waits for
@ -435,7 +435,7 @@ mod tests {
const DAY: i64 = 86_400; const DAY: i64 = 86_400;
/// Self-signed, CN `hive-agent-atlas`, valid 2026-01-01T00:00:00Z to /// Self-signed, CN `hive-agent-atlas`, valid 2026-01-01T00:00:00Z to
/// 2026-04-01T00:00:00Z: 90 days, the agent role's `ttl`. Its key was /// 2026-04-01T00:00:00Z: 90 days, a window the agent role no longer issues. Its key was
/// discarded. /// discarded.
const CERT_PEM: &str = "-----BEGIN CERTIFICATE----- const CERT_PEM: &str = "-----BEGIN CERTIFICATE-----
MIIBizCCATGgAwIBAgIUSFpuYmy1UoHvq/MYiyrAudRaWXcwCgYIKoZIzj0EAwIw MIIBizCCATGgAwIBAgIUSFpuYmy1UoHvq/MYiyrAudRaWXcwCgYIKoZIzj0EAwIw