vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-bao: grant the queue responder the callout issuer and user keys' leaves

Browse source 
The `swarm-nats-auth` policy grants create and read, never update, on the
seed and public half of the callout issuer and user keys, beside the xkey's
two leaves: `ensure-callout-keys` creates them under that role, and the
responder reads both seeds as it starts.

The `swarm-secret-publisher` policy, which may write the rest of
`swarm/services/`, is denied both seed paths exactly, as it is the xkey's.
A planted issuer seed would be the authority to admit anyone to the queue.

Both policies are written by the granter on every deploy; nothing about the
granter's own policy changes.
This commit is contained in:
atlas 2026-10-06 11:46:28 +02:00 • committed by mara
commit 66ac034949
2 changed files with 60 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

47
nix/host-modules/swarm-bao.nix
View file

@ -469,9 +469,11 @@ let
# Write-only. It copies secrets in and never reads one back; a read
# capability would let a file-copier recover every hive's credentials.
#
# The callout xkey's seed sits under `swarm/services/` and is no secret this
# principal copies, so its exact path, which outranks the prefix, is denied:
# a write there would replace the key every queue request is sealed to.
# The queue callout's three seeds sit under `swarm/services/` and are no
# secret this principal copies, so their exact paths, which outrank the
# prefix, are denied. A write to the xkey's would replace the key every
# queue request is sealed to; the issuer's is the authority to admit anyone
# to the queue, and the user's is the one identity exempt from callout.
secretPublisherPolicyText = ''
path "${credentialMountPath}/data/swarm/hives/*" {
capabilities = ["create", "update"]
@ -485,6 +487,14 @@ let
capabilities = ["deny"]
}
path "${credentialMountPath}/data/${issuerSeedLeaf}" {
capabilities = ["deny"]
}
path "${credentialMountPath}/data/${userSeedLeaf}" {
capabilities = ["deny"]
}
path "${credentialMountPath}/data/${controllerClientLeaf}" {
capabilities = ["create", "update"]
}
@ -858,10 +868,10 @@ let
# other credential an agent holds. Plus the responder's own OIDC client
# secret, which `swarm-bao-nats-auth-oidc` reads under this same leaf.
#
# And the callout xkey's two leaves, which `ensure-xkey` creates when the
# store holds no seed. `create` without `update`, so a stored pair is never
# replaced; `read` because creating is read-then-create, and the responder
# loads the seed as it starts.
# And the two leaves of each callout key, which `ensure-callout-keys`
# creates when the store holds no seed. `create` without `update`, so a
# stored pair is never replaced; `read` because creating is
# read-then-create, and the responder loads the seeds as it starts.
natsAuthReaders = [
{
name = "swarm-nats-auth";
@ -869,17 +879,28 @@ let
policyText =
readStanza "${credentialMountPath}/data/swarm/agents/+/queue"
+ readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.nats.clientId}/oidc/client"
+ createStanza "${credentialMountPath}/data/${xkeySeedLeaf}"
+ createStanza "${credentialMountPath}/data/${xkeyPublicLeaf}";
+ lib.concatMapStrings (leaf: createStanza "${credentialMountPath}/data/${leaf}") [
xkeySeedLeaf
xkeyPublicLeaf
issuerSeedLeaf
issuerPublicLeaf
userSeedLeaf
userPublicLeaf
];
}
];
# The callout xkey, the nix half of `swarm-nats-auth`'s `xkey::SEED_PATH`
# and `xkey::PUBLIC_PATH`. Both are readable by the `swarm-nats-auth` role
# alone: `swarm/public/` marks the half that is no secret, and no policy
# opens it to every token.
# The callout's keys, the nix half of `swarm-nats-auth`'s `xkey::SEED_PATH`
# and `xkey::PUBLIC_PATH`, and of the `seed_path` and `public_path` of
# `nkey::ISSUER` and `nkey::USER`. All are readable by the `swarm-nats-auth`
# role alone: `swarm/public/` marks the halves that are no secret, and no
# policy opens them to every token.
xkeySeedLeaf = "swarm/services/swarm-nats/callout/xkey-seed";
xkeyPublicLeaf = "swarm/public/swarm-nats/callout-xkey";
issuerSeedLeaf = "swarm/services/swarm-nats/callout/issuer-seed";
issuerPublicLeaf = "swarm/public/swarm-nats/callout-issuer";
userSeedLeaf = "swarm/services/swarm-nats/callout/user-seed";
userPublicLeaf = "swarm/public/swarm-nats/callout-user";
createStanza = path: ''
path "${path}" {