mesh-tools
bff1ac14a1
mesh/merge-gate head bff1ac14a198 merged into trunk 49c9002c04d3 beside mesh-controller#355@8c381172 — pass: builds mesh-host → ace, g14, novox, shanks; no…
mesh/repo-check head bff1ac14a198 merged into trunk 49c9002c04d3 beside mesh-controller#355@8c381172 — pass: its merge-check.sh passed
mesh/delivery delivered
mesh/delivery-group group release/57-config-and-provisioning merged: every member is merged
63 lines
2.2 KiB
Go
63 lines
2.2 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/novox/mesh-host/internal/identity"
|
|
)
|
|
|
|
// This machine's sealing key, stated to the vault in the engine's own name (novox/hq ADR 0372, issue 786). The vault
|
|
// records it from the machine's own account alone and, when it is a first or a changed key, says the machine's core
|
|
// secrets changed so the controller asks for them again sealed to it. Without this a machine that never moved a
|
|
// secret in (adopted after feature 57) has no key at the vault. Nothing but the public half crosses.
|
|
|
|
const (
|
|
// nodeKeyRetryFrom and nodeKeyRetryUpTo bound the wait between tries while the vault does not answer: it starts
|
|
// after the bus and may not serve the verb yet.
|
|
nodeKeyRetryFrom = 5 * time.Second
|
|
nodeKeyRetryUpTo = 5 * time.Minute
|
|
// nodeKeyLook is how often the key file is read to see whether it changed.
|
|
nodeKeyLook = 30 * time.Second
|
|
)
|
|
|
|
// keepNodeKeyStated states the sealing key load answers to the vault at start, retrying with a growing wait from
|
|
// retryFrom to retryUpTo while it does not answer, and states it again whenever the key changes. It says one line
|
|
// when a key is stated and one when a try fails for another reason than the last, and returns when ctx ends.
|
|
func keepNodeKeyStated(ctx context.Context, load func() (identity.SealingKey, error), ask vaultAsk, say func(string),
|
|
retryFrom, retryUpTo time.Duration) {
|
|
stated, lastFailure := "", ""
|
|
wait := retryFrom
|
|
fail := func(why string) {
|
|
if why != lastFailure {
|
|
say("mesh-host: the sealing key was not stated to the vault, trying again: " + why)
|
|
lastFailure = why
|
|
}
|
|
wait = min(wait*2, retryUpTo)
|
|
}
|
|
look := min(nodeKeyLook, retryFrom)
|
|
for {
|
|
delay := look
|
|
key, err := load()
|
|
switch {
|
|
case err != nil:
|
|
fail(err.Error())
|
|
delay = wait
|
|
case key.Public != stated:
|
|
if _, err := ask("node-key", map[string]string{"key": key.Public}); err != nil {
|
|
fail(err.Error())
|
|
delay = wait
|
|
} else {
|
|
stated, lastFailure, wait = key.Public, "", retryFrom
|
|
say(fmt.Sprintf("mesh-host: this machine's sealing key %s is stated to the vault", key.Public))
|
|
}
|
|
}
|
|
select {
|
|
case <-ctx.Done():
|
|
return
|
|
case <-time.After(delay):
|
|
}
|
|
}
|
|
}
|