vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

mint per-agent proxy credentials and a per-hive squid self-check credential

Browse source
This commit is contained in:
atlas 2026-10-28 13:02:25 +01:00 • committed by mara
commit ec06a91deb
2 changed files with 487 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/host-modules/swarm-bao.nix
View file

@ -486,6 +486,10 @@ let
capabilities = ["create", "read", "update"]
}
path "${credentialMountPath}/data/swarm/hives/+/squid-selfcheck" {
capabilities = ["create", "read"]
}
${lib.concatMapStrings readStanza (
map (leaf: "${credentialMountPath}/data/${leaf}") atticFactLeaves
)}

7
nix/module-eval/bao-grants.nix
View file

@ -1724,17 +1724,20 @@ let
{
# `matrix_account::hive_sender` writes every hive's sender token and
# `forge::hive_token` every hive's forge token, and nothing else under
# `hives/`, where each hive's queue credential also lives. `+` is one
# `hives/`, where each hive's queue credential also lives. `proxy_credential`
# creates each hive's squid self-check credential and reads it back, and
# has no `update`, so it cannot replace one. `+` is one
# segment, which keeps each stanza to its one leaf; a `*` is a glob only
# at the end of a path. Pinned as whole stanzas, so an added capability
# fails.
name = "the controller writes each hive's sender and forge tokens and nothing else under hives";
name = "the controller writes each hive's sender and forge tokens, creates its squid self-check credential, and nothing else under hives";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
in
lib.hasInfix "path \"secret/data/swarm/hives/+/matrix/sender-token\" {\n capabilities = [\"create\", \"read\", \"update\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/hives/+/forge/token\" {\n capabilities = [\"create\", \"read\", \"update\"]\n}" s
&& lib.hasInfix "path \"secret/data/swarm/hives/+/squid-selfcheck\" {\n capabilities = [\"create\", \"read\"]\n}" s
&& !(lib.hasInfix "secret/data/swarm/hives/*" s)
&& !(lib.hasInfix "secret/metadata/swarm/hives" s);
}