vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

docs: builder.md says the client secret is re-read on refusal too

Browse source 
The builder reads its queue client secret at start and again when
authelia refuses it. The credentials table in builder.md and the
swarm-builder README still said it was read only at start.
This commit is contained in:
atlas 2026-10-13 20:48:26 +02:00
commit 6d7fc0dd99
2 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/swarm/builder.md
View file

@ -59,11 +59,11 @@ Where it runs and how it's enabled: [`services.md`](services.md#builder).
## Credentials
| What | Where | Who reads it |
| ----------------------- | ------------------------------------------------- | ---------------------------------------- |
| store leaf | `deploy.bao.builderClient{Cert,Key}File` | nspawn, into the service as a credential |
| queue client secret | `secret/swarm/services/swarm-builder/oidc/client` | the builder, at start |
| forge token (read-only) | `secret/swarm/services/builder/forge/token` | the builder, on every build |
| What | Where | Who reads it |
| ----------------------- | ------------------------------------------------- | -------------------------------------------------- |
| store leaf | `deploy.bao.builderClient{Cert,Key}File` | nspawn, into the service as a credential |
| queue client secret | `secret/swarm/services/swarm-builder/oidc/client` | the builder, at start and when authelia refuses it |
| forge token (read-only) | `secret/swarm/services/builder/forge/token` | the builder, on every build |
The token belongs to the `builder` forge account, which swarm-controller
creates, puts in the `hives` team of `agent-configs` (read on every config

3
swarm-builder/README.md
View file

@ -25,7 +25,8 @@ the answer into a `swarm-builder` commit status on the PR's head.
The container holds one credential: its own store certificate, which nspawn
hands in at start without a copy on disk. With it the service reads its
queue client secret at start and its read-only forge token at every build.
queue client secret at start and again when authelia refuses it, and its
read-only forge token at every build.
`git` gets the token through a credential helper reading the child's
environment, never in a URL or an argument, and the helper answers only an
`https` request for the forge's host. Its store role reads exactly