Watch

atlas ddb7d7196d matrix: swarm-controller is the only minter

Every hive is in a swarm and every swarm runs matrix, so every swarm has a
swarm-controller, and since #4810 its hive_sender pass mints each hive's
@hive-<hive>: sender token into the store every five minutes. The two
other minters of that token go:

- swarm-matrix-ctl mint: the systemd.services.swarm-matrix-ctl unit in the
  hive-matrix container, Command::Mint and src/mint.rs. The binary, its
  appservice render/publish verbs, ctlPackage, ctlActive and the ctl cert
  role stay. bao-matrix-reader's checks on the deleted unit are removed;
  the leaf-identity and no-token-in-env checks now look at
  swarm-matrix-appservice-publish, which runs under the same identity.
- the hive-side mint ladder in hive-c0re's ensure_hive_user
  (register/appservice-login/password-login with the local as_token), with
  read_appservice_token, paths::matrix_appservice_token and the helpers
  only it used. ensure_hive_user now takes the store's token, keeps the
  file when the store has none or can't be reached, and fails otherwise.
- hivectl matrix sync-admin: the verb, HostRequest::MatrixSyncAdmin and
  handle_matrix_sync_admin. The periodic MatrixSweep (ensure_all) is
  unchanged apart from no longer reading the local as_token.

This removes the double-mint race #4810's review flagged: two minters
logging in on one pinned device could leave a dead token in the store
until the next pass.

Closes #4813
Closes #4814

2026-09-30 00:46:46 +02:00

1.2 KiB

Raw Blame History

swarm-matrix-ctl

The rust that runs inside containers.hive-matrix, beside the homeserver.

One binary with subcommands rather than one binary per job. Running code in that container is not free: it needs its own store identity, its own cert role and its own bind mounts, and every one of those is per-container, not per-task. A second single-purpose crate would have had to duplicate that plumbing to add one action, so the next thing that has to run in here is a verb, not a new crate.

Verbs

`appservice render`

Mints the swarm appservice registration's tokens when absent and renders the registration tuwunel loads. Runs before the homeserver and needs no network.

`appservice publish`

Writes the rendered as_token to the swarm secret store for swarm-controller, when the store's copy differs.

Both are configured entirely by the MATRIX_APPSERVICE_* environment the units set — no flags. A systemd Environment= block is what a nix module can render; a command line full of paths is not.

🩸 A secret is a path, never a value

Nothing here logs, prints or interpolates a token. The one identifier this binary logs is the store path it wrote.

1.2 KiB Raw Blame History