vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

swarm-bao: the reader's identity is not a store-runner option

Browse source 
The block header says `deploy.bao.*` is what the host RUNNING the store
decides and that none of it means anything on a host that only reads
secrets. Three options in that block are exactly what a read-only host must
set, and their own descriptions say so a screen further down — so reading
the options never corrects the header.

It reads as though an off-host reader were inexpressible. It is already
supported: glue-matrix-bao-token gates on the identity rather than on
`enable`, and module-eval's baoRemoteReader is that deployment.

Also drops a sentence describing what used to be undeclarable.
This commit is contained in:
atlas 2026-09-02 23:51:07 +02:00 • committed by mara
commit d6d60ff06e
1 changed files with 12 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/host-modules/swarm-bao.nix
View file

@ -245,10 +245,17 @@ in
{
# One service, two namespaces, and the split decides who may set what.
#
# `deploy.bao.*` is what the host RUNNING the store decides: whether to run
# it (`enable`, declared in ./deploy.nix with its siblings), which build,
# how the root key is sealed, what it listens on. None of it means anything
# on a host that only reads secrets.
# `deploy.bao.*` is mostly what the host RUNNING the store decides: whether
# to run it (`enable`, declared in ./deploy.nix with its siblings), which
# build, how the root key is sealed, what it listens on.
#
# ⚠️ Except the reader's own identity. `clientCertFile`, `clientKeyFile` and
# `serverCaFile` live here too, and they are set by whoever authenticates TO
# the store — which includes a host that runs none of it. A reader is defined
# by holding a certificate the store accepts, never by sharing a host with
# one; ./glue-matrix-bao-token.nix gates on exactly that and not on `enable`.
# Reading this block as store-runner-only is what makes an off-host reader
# look inexpressible when it is already supported.
#
# `swarm.bao.*` below is what every host in the swarm has to agree on — the
# name the store answers to, its port, its container. A host that is purely
@ -378,9 +385,7 @@ in
Certificate a **reader on this machine** presents to the store.
The counterpart to {option}`services.hyperhive.deploy.bao.clientCaFile`,
which is the store's side of the same handshake. Only the store's side
was declarable, so a hive that did not run the store had no way to be
pointed at a certificate even when one was placed for it.
which is the store's side of the same handshake.
On a hive that runs the store, a glue module supplies the leaf it minted,
as a `mkDefault`. Everywhere else this is the credential an operator