vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

docs: builder.md says the client secret is re-read on refusal too

Browse source 
The builder reads its queue client secret at start and again when
authelia refuses it. The credentials table in builder.md and the
swarm-builder README still said it was read only at start.
This commit is contained in:
atlas 2026-10-13 20:48:26 +02:00
commit 6d7fc0dd99
2 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

3
swarm-builder/README.md
View file

@ -25,7 +25,8 @@ the answer into a `swarm-builder` commit status on the PR's head.
The container holds one credential: its own store certificate, which nspawn
hands in at start without a copy on disk. With it the service reads its
queue client secret at start and its read-only forge token at every build.
queue client secret at start and again when authelia refuses it, and its
read-only forge token at every build.
`git` gets the token through a credential helper reading the child's
environment, never in a URL or an argument, and the helper answers only an
`https` request for the forge's host. Its store role reads exactly