vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm CA: say when tmpfiles deletes the old CA files

Browse source 
`systemd-tmpfiles` removes them at boot and when a switch changes the
host's `tmpfiles.d` rules, not on every deploy.
This commit is contained in:
atlas 2026-10-05 20:47:24 +02:00 • committed by mara
commit b6f5cb0479
1 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/swarm/ca.md
View file

@ -169,11 +169,12 @@ others.
No host holds a CA or its key, except the store's mTLS CA
(`glue-bao-tls.nix`), which signs only the store's server certificate and the
certificates that log in to it. At boot and on every deploy, every host
deletes `/var/lib/swarm-ca` and the `ca.pem`, `ca-previous.pem`,
`ca-key.pem`, `ca.srl` and `.swarm-ca-adopted` in
`<deploy.hive-controller.tls.stateDir>`. The swarm distributes only
certificates.
certificates that log in to it. Every host deletes `/var/lib/swarm-ca` and
the `ca.pem`, `ca-previous.pem`, `ca-key.pem`, `ca.srl` and
`.swarm-ca-adopted` in
`<deploy.hive-controller.tls.stateDir>`: `systemd-tmpfiles` removes them at
boot, and on a deploy that changes the host's `tmpfiles.d` rules. The swarm
distributes only certificates.
⚠️ **The deletion is irreversible.** Rolling back to a generation that still
has `swarm-ca.service` finds no root under `/var/lib/swarm-ca` and mints a