mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-13 06:06:38 +00:00
evangelostsak
dae11dd57e
Every credential generator in this package is single-host scoped. credentials_generator shells out once per (app_id, host_vars_file) pair, and that subprocess sees one host's inventory with no knowledge of any other. A mesh credential breaks the assumption: the value one host receives is derived from a secret minted for a different host, because a peer holds the public half of a key whose private half lives elsewhere. This package is the missing writer that sees the whole host set at once, so a mesh is written complete or not at all. It is specified as cross-host credential generation rather than as a WireGuard utility -- the application id is a parameter and a mesh is a named hub-and-spoke grouping of inventory hosts, so a later consumer needing paired secrets reuses it unmodified. Planning is a pure function of the inventory, the spec and the public keys that already exist, so mesh completeness, key pairing and rotation are provable without a deploy. Keys are minted in-process with Curve25519 in the encoding WireGuard expects, so the controller needs no wg binary to plan a mesh it never joins, and a public key is always derived from its private half rather than stored, because a stored pair can drift into a mesh that looks configured and never handshakes. Group membership is read across every inventory file it is spread over: the swarm lab keeps its backup host in a sibling backup.yml, so a mesh spanning both planes is only complete when both files have been read. Vault encryption is salted, so a member that already holds a key is left untouched rather than re-encrypted; otherwise every run would rewrite the file and no deploy could be a no-op.
27 lines
956 B
Python
27 lines
956 B
Python
"""Cross-host credential generation.
|
|
|
|
Every other generator in this package is single-host scoped: it is handed one
|
|
``host_vars`` file and mints secrets that depend on nothing outside it. A mesh
|
|
credential breaks that assumption, because the value one host receives is
|
|
derived from a secret minted for a different host -- a peer holds the public
|
|
half of a key whose private half lives somewhere else.
|
|
|
|
This package is the single writer that sees the whole host set at once, so a
|
|
mesh is always written complete or not at all. It knows nothing about
|
|
WireGuard: a mesh is a named hub-and-spoke grouping of inventory hosts, each
|
|
member carrying a keypair and the public halves of the peers it may reach.
|
|
"""
|
|
|
|
from .model import Mesh, MeshMember, MeshSpec
|
|
from .plan import plan_mesh
|
|
from .write import existing_public_keys, write_mesh
|
|
|
|
__all__ = [
|
|
"Mesh",
|
|
"MeshMember",
|
|
"MeshSpec",
|
|
"existing_public_keys",
|
|
"plan_mesh",
|
|
"write_mesh",
|
|
]
|