From a597b6bb1c7016770f2fbed37eaec1e0378a7671 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Fri, 11 Sep 2026 22:45:15 +0200
Subject: [PATCH] =?UTF-8?q?swarm-bao:=20the=20secret=20publisher's=20polic?=
 =?UTF-8?q?y=20=E2=80=94=20one=20grant,=20under=20the=20hive=20prefix=20on?=
 =?UTF-8?q?ly?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Write-only `create`/`update` on `secret/data/swarm/hives/*`, and nothing else.
It copies secrets in and never reads one back; a read capability would let a
file-copier recover every hive's credentials rather than merely replace them.

`hives/` and not `swarm/*` because this principal has no business with an
agent's or a service's credentials, and the hive prefix is the only one whose
paths it produces. `secret/data/` is KV v2's ACL prefix, inserted by the engine
rather than written by the caller — the same trap the controller's grant
documents one binding up.

Named outside `hive-*`: the controller may create policies under that prefix,
and a policy it can rewrite is not a constraint on it.

The unit that writes this lands next. Refs #3853
---
 nix/host-modules/swarm-bao.nix | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 100a26c1..bede4e26 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -203,6 +203,29 @@ let
     }
   '';
 
+  # The identity that copies authelia's minted OIDC client secrets into the
+  # store. Named outside `hive-*` for the same reason as the controller's: the
+  # controller may create policies under that prefix, and a policy it can
+  # rewrite is not a constraint on anything.
+  secretPublisherPolicyName = "swarm-secret-publisher";
+
+  # One grant, and every narrowing in it is load-bearing.
+  #
+  # `secret/data/` is KV v2's ACL prefix, inserted by the engine rather than
+  # written by the caller — same trap as the controller's grant above.
+  #
+  # `hives/` and not `swarm/*`: this principal has no business with an agent's
+  # or a service's credentials, and the hive prefix is the only one whose paths
+  # it produces.
+  #
+  # Write-only. It copies secrets in and never reads one back; a read
+  # capability would let a file-copier recover every hive's credentials.
+  secretPublisherPolicyText = ''
+    path "${credentialMountPath}/data/swarm/hives/*" {
+      capabilities = ["create", "update"]
+    }
+  '';
+
   # The KV v2 engine the controller writes agent credentials through. Named
   # once because the grant above and the `secrets enable` in the bootstrap unit
   # have to agree: a policy pointing at a mount nobody created is precisely the