vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-bao: the agent-token checkers' cert roles issue batch tokens

Browse source
This commit is contained in:
atlas 2026-10-17 15:08:02 +02:00 • committed by mara
commit de4871cab1
3 changed files with 56 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nix/module-eval/bao-grants.nix
View file

@ -815,6 +815,33 @@ let
&& lib.hasInfix "allowed_common_names=swarm-metrics-auth" s
&& lib.hasInfix "token_policies=swarm-metrics-auth" s;
}
{
# The three agent-token checkers log in once per check; a batch token
# leaves nothing stored per request. The CI runner's role, written by the
# same helper, keeps service tokens, and still carries its policy, so a
# misspelled script name cannot make the absence pass.
name = "the agent-token checkers' roles issue batch tokens and a holder's role does not";
ok =
let
script = unit: baoGrantHere.systemd.services.${unit}.script;
batch =
unit: role:
let
s = script unit;
in
lib.hasInfix "auth/cert/certs/${role} " s
&& lib.hasInfix "token_type=batch" s
&& lib.hasInfix "token_ttl=5m" s
&& !(lib.hasInfix "token_max_ttl" s);
ci = script "swarm-bao-ci-runner-policy";
in
batch "swarm-bao-nats-auth-policy" "swarm-nats-auth"
&& batch "swarm-bao-logs-auth-policy" "swarm-logs-auth"
&& batch "swarm-bao-metrics-auth-policy" "swarm-metrics-auth"
&& lib.hasInfix "token_policies=swarm-ci-runner" ci
&& !(lib.hasInfix "token_type" ci)
&& !(lib.hasInfix "token_ttl" ci);
}
{
name = "the PKI unit signs the metrics store responder's leaf under its own subject";
ok =