vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: the hive's leaf does not read every secret in the store

Browse source 
Six more comments and option descriptions across five modules said the hive's leaf or grant reads every secret in the store. It reads swarm/agents/* and swarm/hives/<hive>/* and nothing else, so they now say that, in the wording the clientCertFile option already used. Also the matrix-ctl check's label no longer calls the hive's leaf store-wide.
This commit is contained in:
iris 2026-10-12 00:49:44 +02:00 • committed by mara
commit d39ad6c465
7 changed files with 22 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/swarm-bao.nix
View file

@ -1583,8 +1583,9 @@ in
the narrowest of the three: its grant is one path, that
credential itself. The point of the whole arrangement is that the
process holding the appservice token is not the hive, so handing it
the hive's own leaf — which reads every secret in the store — would
give the separation away in one line.
the hive's own leaf — which reads every agent credential in the swarm
and this hive's own secrets — would give the separation away in one
line.
⚠️ Same collision as its siblings, and the same answer: ./swarm.nix
feeds this value into the guard on
@ -2282,7 +2283,8 @@ in
normally gets both from ./glue-bao-tls.nix.
⚠️ Not deploy.bao.clientCertFile. That one is the hive's, and its
grant reads every secret in the store; this role reads one path.
grant reads every agent credential in the swarm and this hive's
own secrets; this role reads one path.
'';
}
{