vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

docs: put the credentials prose on the overview and the tables on the reference

Browse source 
The folded-in secrets.md text sat after the reference's table, so the
reference was half prose. The overview now holds all the prose (where a
secret lives, topologies, the swarm- and hive-level notes, how a reader
reaches the store, the browser UI, adding a secret) and the reference holds
only the tables, each pointing at the section that explains it. No text
dropped; links that asked for the explanation now go to the overview, and
the ones that asked for a list or a row go to the reference.
This commit is contained in:
iris 2026-10-26 18:05:38 +01:00 • committed by mara
commit b53365e371
18 changed files with 618 additions and 593 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/host-modules/nats-callout-removed.nix
View file

@ -20,7 +20,7 @@ let
The queue's callout issuer and user keys live in the swarm secret store:
swarm-bao-nats-callout-xkey creates them there, and the server renders
their public halves from it. Remove this definition. See
docs/swarm/credentials-reference.md.
docs/swarm/credentials.md.
'';
# The seed-file options name a key an operator may want to keep.
seedFile = name: ''

2
nix/host-modules/otel.nix
View file

@ -895,7 +895,7 @@ in
the default is the file swarm-bao-hive-otel-oidc.service fetches
under it. On a hive that runs the store both are set already;
elsewhere place the hive's leaf and name it there — see
docs/swarm/credentials-reference.md.
docs/swarm/credentials.md.
'';
}
{

2
nix/host-modules/swarm-bao.nix
View file

@ -2,7 +2,7 @@
# `swarm-bao` nixos-container.
#
# Today every credential in ./swarm-*.nix is minted where it is read or copied
# there by a delivery unit (docs/swarm/credentials-reference.md), which ties each secret's
# there by a delivery unit (docs/swarm/credentials.md), which ties each secret's
# lifetime to its container's.
#
# ⚠️ It authenticates hive clients with a CLIENT CERTIFICATE, not with the

4
nix/host-modules/swarm-grafana.nix
View file

@ -592,7 +592,7 @@ in
On a hive that runs the store, glue-bao-tls.nix supplies both as
defaults and there is nothing to do. Elsewhere the leaf is issued
from that CA out of band and named here — see docs/swarm/credentials-reference.md.
from that CA out of band and named here — see docs/swarm/credentials.md.
'';
}
{
@ -718,7 +718,7 @@ in
# with it, so skipping the store when the producer is local would buy a
# round trip and cost a second delivery path, a second way for the file
# to be wrong, and a gate whose false arm is a Grafana with no login.
# Recorded in docs/swarm/credentials-reference.md.
# Recorded in docs/swarm/credentials.md.
#
# It is a store reader, and this is what the store's readers do: a cert
# login that fails LOUDLY, since every state it fails on is one a retry

2
nix/host-modules/swarm-nats.nix
View file

@ -360,7 +360,7 @@ in
# the host running it decides is below — which responder build it runs and
# the store identities its units present. `enable` already lives in
# ./deploy.nix, which also carries the renames. The callout's keys are no
# option at all: they live in the secret store (docs/swarm/credentials-reference.md).
# option at all: they live in the secret store (docs/swarm/credentials.md).
options.services.hyperhive.deploy.nats = {
authPackage = lib.mkOption {
type = lib.types.package;

4
nix/host-modules/swarm-otel.nix
View file

@ -545,7 +545,7 @@ in
# tree: that is reachable only where authelia shares this host's network
# namespace, and breaks the moment authelia is on another host. The store
# exists so a host holds ONE out-of-band secret — its client certificate —
# and reads everything else with it. Recorded in docs/swarm/credentials-reference.md.
# and reads everything else with it. Recorded in docs/swarm/credentials.md.
#
# Shaped after ./swarm-grafana.nix's store reader: a cert login that fails
# LOUDLY, since every state it fails on is one a retry fixes, then a read
@ -801,7 +801,7 @@ in
On a hive that runs the store, glue-bao-tls.nix supplies both as
defaults and there is nothing to do. Elsewhere the leaf is issued
from that CA out of band and named here — see docs/swarm/credentials-reference.md.
from that CA out of band and named here — see docs/swarm/credentials.md.
'';
}
# ⚠️ There is deliberately no assertion that this collector has