vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

document squid's proxy credentials

Browse source
This commit is contained in:
atlas 2026-10-28 13:07:15 +01:00 • committed by mara
commit 8328c38a07
1 changed files with 34 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/swarm/ca.md
View file

@ -22,8 +22,10 @@ hive's domain and `*.<hive domain>`, read from
`services.hyperhive.swarm.hives.<name>.domain` on the store's host, with no
IP SANs and no `localhost`. A request for any other name is a refusal from
the store naming that name. The hive's policy grants `update` on that one
issue path and `read` on its own `attic/public-key` and `attic/pull-token`
(see [the cache facts for hive-priv](credentials-reference.md)), and nothing
issue path and `read` on its own `attic/public-key`, `attic/pull-token` and
`squid-selfcheck`
(see [the cache facts for hive-priv](credentials-reference.md) and the
squid self-check password), and nothing
else. `swarm-bao-hive-leaf-policy.service`, on the
store's host, writes the role, the policy and the cert-auth role for every
hive in `swarm.hives`.