vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep the cache's key and pull token for hive-priv in a root-only directory

Browse source
This commit is contained in:
atlas 2026-10-28 02:21:01 +01:00
commit b845630023
1 changed files with 519 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nix/module-eval/bao-grants.nix
View file

@ -1496,9 +1496,9 @@ let
{
# One role, policy and login role per hive in the directory, each
# naming only its own hive: the policy text in the unit is exactly the
# two `update` grants, and each hive's block names neither the other's
# role nor its subject.
name = "each hive's gateway-leaf identity may issue from its own role alone, for its own domain and dashboard";
# `update` on its own role and `read` on its own two cache facts, and each
# hive's block names neither the other's role nor its subject.
name = "each hive's gateway-leaf identity may issue from its own role and read its own two cache facts, and nothing else";
ok =
let
s = baoGrantTwoHives.systemd.services.swarm-bao-hive-leaf-policy.script;
@ -1528,10 +1528,26 @@ let
path = "pki/issue/swarm-hive-leaf-h1";
caps = [ "update" ];
}
{
path = "secret/data/swarm/hives/h1/attic/public-key";
caps = [ "read" ];
}
{
path = "secret/data/swarm/hives/h1/attic/pull-token";
caps = [ "read" ];
}
{
path = "pki/issue/swarm-hive-leaf-h2";
caps = [ "update" ];
}
{
path = "secret/data/swarm/hives/h2/attic/public-key";
caps = [ "read" ];
}
{
path = "secret/data/swarm/hives/h2/attic/pull-token";
caps = [ "read" ];
}
]
&& issues "h1" "h1.t.local" h1
&& issues "h2" "h2.example.org" h2