vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats-auth: read the callout issuer and user seeds from the store

Browse source 
The responder loads the issuer and callout-user seeds from the secret
store under its own role, beside the xkey, and no longer takes
--issuer-seed-file / --user-seed-file.

`ensure-xkey` becomes `ensure-callout-keys`: it ensures the xkey as before,
and for each nkey creates the seed create-only when the store holds none,
from --import-{issuer,user}-seed-file when that file is present, so a key
kept on disk keeps its public half. Once a read of the store returns a seed,
the import file is removed; when that seed differs from the file the
store's is kept and a warning names the file. The public halves are
published create-only at swarm/public/swarm-nats/callout-{issuer,user}.

The KeyStore trait and its test double move to `keystore` so both key
modules share them.
This commit is contained in:
atlas 2026-10-06 10:13:34 +02:00 • committed by mara
commit 8a4bb97377
5 changed files with 610 additions and 174 deletions
Download patch file Download diff file Expand all files Collapse all files

11
swarm-nats-auth/README.md
View file

@ -41,10 +41,13 @@ with the xkey's seed and seals its reply to that header's key. The responder
logs a warning for a request with no header, or one that doesn't open, and
sends no reply: the server it serves always seals, so no server waits on one.
The seed is in the swarm secret store, and the responder reads it before it
connects to the queue: a responder without it doesn't start. The
`ensure-xkey` verb creates the pair when the store holds none. It runs from
its own unit before the server, because the server needs the public half to
The seed is in the swarm secret store, and so are the seeds of the issuer key
the responder signs with and the user key it connects as. The responder reads
all three before it connects to the queue: a responder missing one doesn't
start. The `ensure-callout-keys` verb creates each pair when the store holds
none, taking an issuer or user seed from the import file it is given when that
file exists, and removes the file once the store holds a seed. It runs from
its own unit before the server, because the server needs the public halves to
start and the responder needs the server. `docs/swarm/secrets.md` has the
paths and the boot order.