mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 04:06:42 +00:00
evangelostsak
dae11dd57e
Every credential generator in this package is single-host scoped. credentials_generator shells out once per (app_id, host_vars_file) pair, and that subprocess sees one host's inventory with no knowledge of any other. A mesh credential breaks the assumption: the value one host receives is derived from a secret minted for a different host, because a peer holds the public half of a key whose private half lives elsewhere. This package is the missing writer that sees the whole host set at once, so a mesh is written complete or not at all. It is specified as cross-host credential generation rather than as a WireGuard utility -- the application id is a parameter and a mesh is a named hub-and-spoke grouping of inventory hosts, so a later consumer needing paired secrets reuses it unmodified. Planning is a pure function of the inventory, the spec and the public keys that already exist, so mesh completeness, key pairing and rotation are provable without a deploy. Keys are minted in-process with Curve25519 in the encoding WireGuard expects, so the controller needs no wg binary to plan a mesh it never joins, and a public key is always derived from its private half rather than stored, because a stored pair can drift into a mesh that looks configured and never handshakes. Group membership is read across every inventory file it is spread over: the swarm lab keeps its backup host in a sibling backup.yml, so a mesh spanning both planes is only complete when both files have been read. Vault encryption is salted, so a member that already holds a key is left untouched rather than re-encrypted; otherwise every run would rewrite the file and no deploy could be a no-op.