vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep the matrix appservice registration in bao, with the host file as the last copy

Browse source
This commit is contained in:
atlas 2026-10-27 13:52:17 +01:00
commit d5c5862654
1 changed files with 1014 additions and 273 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nix/module-eval/bao-grants.nix
View file

@ -575,12 +575,13 @@ let
# prefix the publisher holds would be a real loss even though it would
# read as tidier.
#
# The first leaf is the swarm appservice token, which matrix-ctl mints
# and publishes for the controller; the second and third are the
# homeserver's own OIDC client secret and its container forwarder's,
# read-only. The whole list, so a fourth stanza fails rather than riding
# The first leaf is the swarm appservice token, which matrix-ctl derives
# and publishes for the controller; the second is the registration it
# derives that from, `create` and `read` only; the third and fourth are
# the homeserver's own OIDC client secret and its container forwarder's,
# read-only. The whole list, so a fifth stanza fails rather than riding
# along beside correct ones.
name = "matrix-ctl's grant is the swarm appservice token and the homeserver's and its forwarder's OIDC secrets, nothing else";
name = "matrix-ctl's grant is the swarm appservice token and registration and the homeserver's and its forwarder's OIDC secrets, nothing else";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-matrix-ctl-policy.script;
@ -594,6 +595,13 @@ let
"read"
];
}
{
path = "secret/data/swarm/controller/swarm-controller/matrix/appservice-registration";
caps = [
"create"
"read"
];
}
{
path = "secret/data/swarm/services/tuwunel/oidc/client";
caps = [ "read" ];
@ -611,8 +619,9 @@ let
}
{
# 🩸 `read` is load-bearing here, unlike on the publisher: matrix-ctl's
# `appservice publish` reads the swarm appservice token back and writes
# only when the store's copy differs.
# `appservice sync` reads the swarm appservice token back and writes
# only when the store's copy differs, and reads the registration before
# it creates it.
name = "matrix-ctl may read back what it writes";
ok =
let
@ -2238,7 +2247,9 @@ let
# it: matrix-ctl is its one writer. Pinned as the whole stanza, so an
# added capability fails.
name = "the controller reads the swarm appservice token and cannot write it";
ok = lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/matrix/appservice-token\" {\n capabilities = [\"read\"]\n}" baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
ok =
lib.hasInfix "path \"secret/data/swarm/controller/swarm-controller/matrix/appservice-token\" {\n capabilities = [\"read\"]\n}" baoGrantHere.systemd.services.swarm-bao-controller-policy.script
&& !(lib.hasInfix "appservice-registration" baoGrantHere.systemd.services.swarm-bao-controller-policy.script);
}
{
# The controller's own OIDC client secret, which the publisher writes and