78ebd7db3f
Both referenced the now-deleted nix/module-eval.nix. The nix side of each pairing is spread across multiple files post-split, so drop the cross-reference rather than chase it across files.
25 lines
1 KiB
Rust
25 lines
1 KiB
Rust
//! The controller's own identity at the swarm's secret store.
|
|
//!
|
|
//! Two paths log in: writing an agent's credential, and writing the read
|
|
//! grant that lets a hive fetch one back. Both present the same certificate
|
|
//! under the same role, so the role is named here rather than at each caller.
|
|
|
|
use swarm_secret_client::{Error, SecretStore};
|
|
|
|
/// The cert-auth role the controller logs in under.
|
|
///
|
|
/// `nix/host-modules/swarm-bao.nix`'s `controllerPolicyName` creates the
|
|
/// role and names the policy after it.
|
|
///
|
|
/// ⚠️ Not the certificate's CN. The role *matches on* the CN
|
|
/// (`allowed_common_names`), so the two are deliberately different strings.
|
|
pub const CERT_ROLE: &str = "swarm-controller";
|
|
|
|
/// Log in to the store with this deployment's certificate.
|
|
///
|
|
/// # Errors
|
|
/// Whatever [`SecretStore::from_env`] raises — an unset `BAO_*` variable, an
|
|
/// unreadable identity file, or a store that refuses the login.
|
|
pub async fn connect() -> Result<SecretStore, Error> {
|
|
SecretStore::from_env(CERT_ROLE).await
|
|
}
|