vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats-auth: refuse an auth request the server did not seal

Browse source 
Every nats-server this module starts renders `auth_callout.xkey` or does
not start, and the responder serves only that server, in the same
container and generation. A request without `Nats-Server-Xkey` therefore
comes from no supported server, so the plaintext framing is gone: such a
request is logged at warn and gets no reply, and the server that sent it
times out the connect as a denial. A signed denial would have had to go
out unsealed, which is the path this removes.

Also scopes two claims to what is true: the xkey's public half is read by
the swarm-nats-auth policy only, and the metadata-delete gap in the
replace-key procedure is about the two xkey paths, not all of
`secret/metadata/`.
This commit is contained in:
atlas 2026-10-05 22:46:52 +02:00 • committed by mara
commit 923554cd62
5 changed files with 78 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nix/host-modules/swarm-nats.nix
View file

@ -221,9 +221,10 @@ let
userPublicFile = "callout-user.pub";
issuerPublicFile = "issuer.pub";
# The callout xkey's public half in the store, readable by any token. The
# Rust half is `swarm-nats-auth`'s `xkey::PUBLIC_PATH`; the seed beside it
# is `xkeySeedLeaf` in ./swarm-bao.nix.
# The callout xkey's public half in the store, readable by the
# `swarm-nats-auth` role alone. The Rust half is `swarm-nats-auth`'s
# `xkey::PUBLIC_PATH`; the seed beside it is `xkeySeedLeaf` in
# ./swarm-bao.nix.
xkeyPublicPath = "secret/swarm/public/swarm-nats/callout-xkey";
# Each placeholder in `calloutTemplate`, as a `sed` expression over the