vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

docs/swarm/credentials: a hive is an identity too

Browse source 
Line 26's list named two identity kinds; mara flagged it as
should-be-three and the third went unnamed. A hive holds its own mTLS
leaf (glue-bao-tls.nix:130-131, CN = hiveName from :49) and logs in
with it (glue-queue-agent-credential.nix:171, bao login
-method=cert); swarm-bao.nix mints matching cert-auth roles for it
alongside swarm-controller (:1049-1052) and swarm-secret-publisher
(:1101-1104), and swarm-controller/src/read_policy.rs:184-188 writes
the per-hive role dynamically. The table further down this page
already lists a hive as a reader (swarm/hives/<hive>/matrix/appservice-token),
so the line-26 list was inconsistent with the rest of the page.
This commit is contained in:
atlas 2026-09-17 11:54:03 +02:00 • committed by mara
commit 6e23af36c9
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/swarm/credentials.md
View file

@ -23,9 +23,9 @@ the only credential on disk.** Each has to be a file, and the reason is the
whole asymmetry: the certificate is what authenticates a principal to the whole asymmetry: the certificate is what authenticates a principal to the
store, so it's the one credential that can't be fetched from the store. store, so it's the one credential that can't be fetched from the store.
Something has to exist on disk before the first request, or there's nothing Something has to exist on disk before the first request, or there's nothing
to make the request with. Every identity — an agent, a swarm-level service — to make the request with. Every identity — an agent, a hive, a swarm-level
needs one; a host running several holds several, and its only power is to service — needs one; a host running several holds several, and its only
ask the store for the rest. power is to ask the store for the rest.
`swarm-bao.nix:529-533` states the rule for the nix option that carries it: `swarm-bao.nix:529-533` states the rule for the nix option that carries it:
this is _"the credential an operator places by hand"_, and _"a path, never a this is _"the credential an operator places by hand"_, and _"a path, never a
value."_ A literal in a nix expression lands in the nix store — value."_ A literal in a nix expression lands in the nix store —