vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

require both attic options, follow attic's cache-name rule, read the token from a file

Browse source
This commit is contained in:
atlas 2026-10-27 10:46:36 +01:00
commit bd214b9f3e
1 changed files with 156 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/swarm/builder.md
View file

@ -267,12 +267,16 @@ inside the 61 minutes the controller waits. `attic` checks the server's certific
against the system roots and pins nothing, so a Let's Encrypt certificate
works.
Set both options or neither: evaluation refuses a domain without a cache name.
The cache name follows attic's rule, 1 to 50 letters, digits, `-`, `_` or `+`,
starting with a letter or digit, and evaluation refuses any other name.
The push token is the operator's to write. The builder reads it on every push
from `secret/swarm/services/attic/push-token` (field `value`), writes an `attic`
config file holding it in the unit's private runtime directory (`/run/swarm-builder`,
mode `0700`, the file `0600`), points `attic` at it with `XDG_CONFIG_HOME` and
removes it after the push. The token is in no argument or variable, so no
process listing shows it.
from `secret/swarm/services/attic/push-token` (field `value`), writes it to
a file and an `attic` config naming that file (`token-file`) in the unit's private
runtime directory (`/run/swarm-builder`, mode `0700`, both files `0600`), points
`attic` at the config with `XDG_CONFIG_HOME` and removes both after the push.
The token is in no argument or variable, so no process listing shows it.
The reply's `cached` says whether the push finished. A push that fails, times out
or can't read the token leaves the build green with `cached` false and logs a