vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

store the forge webhook secret and grafana's secret key in bao, seeded from the existing files

Browse source
This commit is contained in:
atlas 2026-10-27 12:02:44 +01:00 • committed by mara
commit a4e48a7bca
1 changed files with 697 additions and 142 deletions
Download patch file Download diff file Expand all files Collapse all files

8
swarm-controller/src/main.rs
View file

@ -8,10 +8,10 @@
//! `startup::load_hives`. A config change means a redeploy, same as every other
//! option this process reads.
//!
//! It persists `webhook-secret` under its `StateDirectory` (see `webhook`),
//! It keeps the webhook HMAC secret in the swarm secret store (see `webhook`),
//! because that key is handed to Forgejo at registration and so cannot be
//! regenerated per boot, and the operator admin sync's granted set beside it
//! (see `matrix_account::operator_admin`).
//! regenerated per boot, and the operator admin sync's granted set under its
//! `StateDirectory` (see `matrix_account::operator_admin`).
//!
//! Distinct from `hive-c0re`, which is per-hive: c0re owns the agents on
//! one host, this owns what is true across hives.
@ -179,7 +179,7 @@ async fn main() -> Result<()> {
register_cert_gauges(jobq_metrics_provider.as_ref());
held_deploys::register(jobq_metrics_provider.as_ref(), &jobq);
let webhook_secret = load_webhook_secret();
let webhook_secret = load_webhook_secret().await;
// Diagnostic only — `put_matrix_account` does not call this yet (see its
// own doc comment), so this cannot change any request's outcome. Logged