vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(3112): nkey only, no username on the callout-exempt user

Browse source 
Measured against a running server built from this module's own rendered
config, not a hand-written one -- which is the fix to the method as much
as to the file. Two shapes died in a row: a bare name authenticates
anyone who sends it, and a name plus an nkey refuses to start at all
(nkey users do not take usernames or passwords).

A malformed key is fail-closed too, so the only way to a live server
here is a real key whose seed nobody but the responder holds.
This commit is contained in:
atlas 2026-08-14 12:57:08 +02:00 • committed by mara
commit a8c5877412
1 changed files with 17 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/swarm-nats.nix
View file

@ -16,7 +16,6 @@ let
# authorizes.
calloutAccount = "AUTH";
clientAccount = "APP";
calloutUser = "auth";
in
{
# The swarm's message queue: one NATS server, reached by every hive.
@ -227,12 +226,22 @@ in
# container on the shared netns — the same class of hole
# this module exists to close, moved rather than fixed.
# Caught in review on the first version of this file.
${calloutAccount}.users = [
{
user = calloutUser;
nkey = cfg.calloutUserPublicKey;
}
];
# An nkey and NOTHING else, both halves measured against a
# running server rather than reasoned about:
#
# { user = "auth"; } → `CONNECT {"user":"auth"}`
# is accepted with no
# credential at all
# { user = "auth"; nkey = "U…"; } → refuses to START:
# "Nkey users do not take
# usernames or passwords"
# { nkey = "U…"; } → what this is
#
# A malformed key is fail-closed too: the server exits with
# "Not a valid public nkey for a user" rather than starting
# with a hole. So the only way to get a live server here is
# a real key whose seed nobody but the responder holds.
${calloutAccount}.users = [ { nkey = cfg.calloutUserPublicKey; } ];
${clientAccount} = { };
};
@ -260,7 +269,7 @@ in
# to say yes.
auth_callout = {
issuer = cfg.calloutIssuerPublicKey;
auth_users = [ calloutUser ];
auth_users = [ cfg.calloutUserPublicKey ];
account = calloutAccount;
};
};