vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-bao: the agent-token checkers' cert roles issue batch tokens

Browse source
This commit is contained in:
atlas 2026-10-17 15:08:02 +02:00 • committed by mara
commit de4871cab1
3 changed files with 56 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/swarm/secrets.md
View file

@ -465,6 +465,13 @@ names the hive's own `clientCertFile` and misses a principal's pair has the
build refused, by the module of the reader it missed, naming that pair — see
[what a missing leaf costs](#what-a-missing-leaf-costs) below.
The roles of `swarm-nats-auth`, `swarm-logs-auth` and `swarm-metrics-auth` issue
batch tokens with a five-minute TTL (`token_type=batch`, `token_ttl=5m`). The
responders log in on every check, and the store keeps no record of a batch token,
so unauthenticated requests don't grow its token storage. Nothing can renew
or revoke a batch token. The other roles keep service tokens, because some of
their readers hold a handle for longer than five minutes.
### What a missing leaf costs
Each of the three modules asserts its own pair, on the same condition: **this host