vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

send agent traffic through squid once its hive announces it

Browse source
This commit is contained in:
atlas 2026-10-28 14:35:08 +01:00
commit b551eb02ff
1 changed files with 885 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/trust-boundary/security.md
View file

@ -209,6 +209,11 @@ token policy bounds file reads; network isolation bounds network reach.
nixbld users can't read it. The swarm-minted token lives under
`/run/hive-agent-forge-token/` (`0700` directory, `0400` file), outside
the state dir.
- `/run/hive-agent-proxy-credential/proxy.env` — the agent's egress-proxy
credential inside its proxy URL (`0700` directory, `0600` file, tmpfs). Units
load it as an environment file, so the credential is also in the environment of
every process they start. It authenticates this agent to the hive's squid and
nothing else.
**Policy**: all credential files written to agent state directories MUST be mode
`0600` or stricter. Don't create world-readable secret files in agent state dirs.