From d6d60ff06e8ca30ce9625b4c4b3ccf5effb33e90 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 2 Sep 2026 23:51:07 +0200 Subject: [PATCH] swarm-bao: the reader's identity is not a store-runner option MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The block header says `deploy.bao.*` is what the host RUNNING the store decides and that none of it means anything on a host that only reads secrets. Three options in that block are exactly what a read-only host must set, and their own descriptions say so a screen further down — so reading the options never corrects the header. It reads as though an off-host reader were inexpressible. It is already supported: glue-matrix-bao-token gates on the identity rather than on `enable`, and module-eval's baoRemoteReader is that deployment. Also drops a sentence describing what used to be undeclarable. --- nix/host-modules/swarm-bao.nix | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix index 6ba6e96f..f1031f53 100644 --- a/nix/host-modules/swarm-bao.nix +++ b/nix/host-modules/swarm-bao.nix @@ -245,10 +245,17 @@ in { # One service, two namespaces, and the split decides who may set what. # - # `deploy.bao.*` is what the host RUNNING the store decides: whether to run - # it (`enable`, declared in ./deploy.nix with its siblings), which build, - # how the root key is sealed, what it listens on. None of it means anything - # on a host that only reads secrets. + # `deploy.bao.*` is mostly what the host RUNNING the store decides: whether + # to run it (`enable`, declared in ./deploy.nix with its siblings), which + # build, how the root key is sealed, what it listens on. + # + # ⚠️ Except the reader's own identity. `clientCertFile`, `clientKeyFile` and + # `serverCaFile` live here too, and they are set by whoever authenticates TO + # the store — which includes a host that runs none of it. A reader is defined + # by holding a certificate the store accepts, never by sharing a host with + # one; ./glue-matrix-bao-token.nix gates on exactly that and not on `enable`. + # Reading this block as store-runner-only is what makes an off-host reader + # look inexpressible when it is already supported. # # `swarm.bao.*` below is what every host in the swarm has to agree on — the # name the store answers to, its port, its container. A host that is purely @@ -378,9 +385,7 @@ in Certificate a **reader on this machine** presents to the store. The counterpart to {option}`services.hyperhive.deploy.bao.clientCaFile`, - which is the store's side of the same handshake. Only the store's side - was declarable, so a hive that did not run the store had no way to be - pointed at a certificate even when one was placed for it. + which is the store's side of the same handshake. On a hive that runs the store, a glue module supplies the leaf it minted, as a `mkDefault`. Everywhere else this is the credential an operator