vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm CA: say when tmpfiles deletes the old CA files

Browse source 
`systemd-tmpfiles` removes them at boot and when a switch changes the
host's `tmpfiles.d` rules, not on every deploy.
This commit is contained in:
atlas 2026-10-05 20:47:24 +02:00 • committed by mara
commit b6f5cb0479
1 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/swarm/ca.md
View file

@ -169,11 +169,12 @@ others.
No host holds a CA or its key, except the store's mTLS CA No host holds a CA or its key, except the store's mTLS CA
(`glue-bao-tls.nix`), which signs only the store's server certificate and the (`glue-bao-tls.nix`), which signs only the store's server certificate and the
certificates that log in to it. At boot and on every deploy, every host certificates that log in to it. Every host deletes `/var/lib/swarm-ca` and
deletes `/var/lib/swarm-ca` and the `ca.pem`, `ca-previous.pem`, the `ca.pem`, `ca-previous.pem`, `ca-key.pem`, `ca.srl` and
`ca-key.pem`, `ca.srl` and `.swarm-ca-adopted` in `.swarm-ca-adopted` in
`<deploy.hive-controller.tls.stateDir>`. The swarm distributes only `<deploy.hive-controller.tls.stateDir>`: `systemd-tmpfiles` removes them at
certificates. boot, and on a deploy that changes the host's `tmpfiles.d` rules. The swarm
distributes only certificates.
⚠️ **The deletion is irreversible.** Rolling back to a generation that still ⚠️ **The deletion is irreversible.** Rolling back to a generation that still
has `swarm-ca.service` finds no root under `/var/lib/swarm-ca` and mints a has `swarm-ca.service` finds no root under `/var/lib/swarm-ca` and mints a