From 9fac33a026f9fc32e466693a718fced94782dbe5 Mon Sep 17 00:00:00 2001 From: iris Date: Sun, 20 Sep 2026 02:35:59 +0200 Subject: [PATCH] docs/swarm/secrets.md: fix sense-mis-attribution in certificateFiles rewrite argus caught it on PR #4557 review: 'certificateFiles reads at system build time' hands the option itself a verb it can't perform. The system reads the option's value at build time, not the other way around. --- docs/swarm/secrets.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/swarm/secrets.md b/docs/swarm/secrets.md index 6b9b9b91..a1de5c0a 100644 --- a/docs/swarm/secrets.md +++ b/docs/swarm/secrets.md @@ -318,9 +318,10 @@ Whatever holds the swarm root is therefore what makes swarm-service certificates possible at all. Two things follow: - **The root's private key is a runtime file and must never enter the nix - store**, so nothing build-time can name it — `security.pki.certificateFiles` - reads at system build time, and is the wrong tool here. Trust reaches - containers through a bind-mounted bundle assembled at boot instead. + store**, so nothing build-time can name it — the system reads + `security.pki.certificateFiles`' value at build time, which makes it the + wrong tool here. Trust reaches containers through a bind-mounted bundle + assembled at boot instead. - **On any topology other than all-local, placing that key is an operations decision**, not something this module tree makes for you. A hive that hosts no swarm services needs only the root's _cert_, to trust what others issue.