Document the site hosting credential contract in the integration doc #44

New issue

Closed

opened 2026-09-10 15:12:54 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-09-10 15:12:54 +01:00

Tell a deployment where allod site deploy's credential comes from, in the document that already explains what this repository's modules take from a consumer. Part of allod/strategy#51.

Primary goals:

Named in the integration doc — docs/integration.md ("Module arguments", "Consumer-owned configuration") states that the site namespace reads rclone's default config path, that nexusIdentity.siteHostingConfigFile is what places a file there (allod/secrets#17, allod/archetypes#74), and that no --config is needed once it is set.
The wrapper comment agrees — nix/home.nix:92-114 explains why rclone rides on the allod wrapper's PATH and mentions the hosting credential; one sentence there points at the contract instead of leaving the credential's origin implied.
The lifecycle in one place — create with allod site config once, then move the resulting stanza into the deployment's secrets repository, rotate through rotate-token when allod/nexus#42 lands and by re-encrypting the stanza until then, verify with allod site check.

Current state and specifics

The doc lists module arguments and consumer-owned configuration but says nothing about allod site, whose credential is the one thing on the host that is not yet reproducible from source for a fork. The sequence a fork needs today is scattered across allod/tools usage text, the wrapper comment, and the deployment's own notes.

Scope

In: docs/integration.md and the wrapper comment.

Out: any code; and the rotation tool itself (allod/nexus#42). Land after allod/archetypes#74 so the doc describes something that exists.

Tell a deployment where `allod site deploy`'s credential comes from, in the document that already explains what this repository's modules take from a consumer. Part of allod/strategy#51. Primary goals: - **Named in the integration doc** — `docs/integration.md` ("Module arguments", "Consumer-owned configuration") states that the site namespace reads rclone's default config path, that `nexusIdentity.siteHostingConfigFile` is what places a file there (allod/secrets#17, allod/archetypes#74), and that no `--config` is needed once it is set. - **The wrapper comment agrees** — `nix/home.nix:92-114` explains why rclone rides on the `allod` wrapper's PATH and mentions the hosting credential; one sentence there points at the contract instead of leaving the credential's origin implied. - **The lifecycle in one place** — create with `allod site config` once, then move the resulting stanza into the deployment's secrets repository, rotate through `rotate-token` when allod/nexus#42 lands and by re-encrypting the stanza until then, verify with `allod site check`. ### Current state and specifics The doc lists module arguments and consumer-owned configuration but says nothing about `allod site`, whose credential is the one thing on the host that is not yet reproducible from source for a fork. The sequence a fork needs today is scattered across `allod/tools` usage text, the wrapper comment, and the deployment's own notes. ### Scope In: `docs/integration.md` and the wrapper comment. Out: any code; and the rotation tool itself (allod/nexus#42). Land after allod/archetypes#74 so the doc describes something that exists.

vnprc-agent referenced this issue from allod/strategy

2026-09-10 15:13:22 +01:00

Make allod site usable from a fork #51

vnprc-agent referenced this issue from allod/secrets

2026-09-10 15:13:22 +01:00

Carry the host user's credential files in nexusIdentity #17

vnprc-agent referenced this issue from allod/archetypes

2026-09-10 15:13:22 +01:00

Declare the host user's credential files from the hypervisor identity, as mkDevVm does #74