vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

docs: fold swarm/secrets.md into the credentials reference

Browse source 
secrets.md and credentials-reference.md answered the same question from two
pages. secrets.md's text now follows the reference's table and operating
notes as a 'Where each secret lives' section, unchanged apart from where it
sits. Every link and doc path that named secrets.md (docs, nix comments,
crate READMEs) points at credentials-reference.md; anchors are unchanged.
This commit is contained in:
iris 2026-10-26 17:58:08 +01:00 • committed by mara
commit d273fa8028
20 changed files with 629 additions and 627 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/host-modules/nats-callout-removed.nix
View file

@ -20,7 +20,7 @@ let
The queue's callout issuer and user keys live in the swarm secret store:
swarm-bao-nats-callout-xkey creates them there, and the server renders
their public halves from it. Remove this definition. See
docs/swarm/secrets.md.
docs/swarm/credentials-reference.md.
'';
# The seed-file options name a key an operator may want to keep.
seedFile = name: ''

2
nix/host-modules/otel.nix
View file

@ -895,7 +895,7 @@ in
the default is the file swarm-bao-hive-otel-oidc.service fetches
under it. On a hive that runs the store both are set already;
elsewhere place the hive's leaf and name it there — see
docs/swarm/secrets.md.
docs/swarm/credentials-reference.md.
'';
}
{

2
nix/host-modules/swarm-bao.nix
View file

@ -2,7 +2,7 @@
# `swarm-bao` nixos-container.
#
# Today every credential in ./swarm-*.nix is minted where it is read or copied
# there by a delivery unit (docs/swarm/secrets.md), which ties each secret's
# there by a delivery unit (docs/swarm/credentials-reference.md), which ties each secret's
# lifetime to its container's.
#
# ⚠️ It authenticates hive clients with a CLIENT CERTIFICATE, not with the

4
nix/host-modules/swarm-grafana.nix
View file

@ -592,7 +592,7 @@ in
On a hive that runs the store, glue-bao-tls.nix supplies both as
defaults and there is nothing to do. Elsewhere the leaf is issued
from that CA out of band and named here — see docs/swarm/secrets.md.
from that CA out of band and named here — see docs/swarm/credentials-reference.md.
'';
}
{
@ -718,7 +718,7 @@ in
# with it, so skipping the store when the producer is local would buy a
# round trip and cost a second delivery path, a second way for the file
# to be wrong, and a gate whose false arm is a Grafana with no login.
# Recorded in docs/swarm/secrets.md.
# Recorded in docs/swarm/credentials-reference.md.
#
# It is a store reader, and this is what the store's readers do: a cert
# login that fails LOUDLY, since every state it fails on is one a retry

2
nix/host-modules/swarm-nats.nix
View file

@ -360,7 +360,7 @@ in
# the host running it decides is below — which responder build it runs and
# the store identities its units present. `enable` already lives in
# ./deploy.nix, which also carries the renames. The callout's keys are no
# option at all: they live in the secret store (docs/swarm/secrets.md).
# option at all: they live in the secret store (docs/swarm/credentials-reference.md).
options.services.hyperhive.deploy.nats = {
authPackage = lib.mkOption {
type = lib.types.package;

4
nix/host-modules/swarm-otel.nix
View file

@ -545,7 +545,7 @@ in
# tree: that is reachable only where authelia shares this host's network
# namespace, and breaks the moment authelia is on another host. The store
# exists so a host holds ONE out-of-band secret — its client certificate —
# and reads everything else with it. Recorded in docs/swarm/secrets.md.
# and reads everything else with it. Recorded in docs/swarm/credentials-reference.md.
#
# Shaped after ./swarm-grafana.nix's store reader: a cert login that fails
# LOUDLY, since every state it fails on is one a retry fixes, then a read
@ -801,7 +801,7 @@ in
On a hive that runs the store, glue-bao-tls.nix supplies both as
defaults and there is nothing to do. Elsewhere the leaf is issued
from that CA out of band and named here — see docs/swarm/secrets.md.
from that CA out of band and named here — see docs/swarm/credentials-reference.md.
'';
}
# ⚠️ There is deliberately no assertion that this collector has