diff options
Diffstat (limited to 'src/config')
| -rw-r--r-- | src/config/mod.rs | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/src/config/mod.rs b/src/config/mod.rs index 0da7ed7..9d918f7 100644 --- a/src/config/mod.rs +++ b/src/config/mod.rs @@ -159,6 +159,13 @@ pub(crate) const OPTIONS: &[OptionSpec] = &[ "With genesis: give the new swarm a user registry (docs/access.md), these its first users, each may do everything, protocol data and managing users included; other users may do nothing until added. Unset, the swarm has no registry: its users are all alike, and only those in protocol-writers write protocol data.", ), option( + "bootstrap-keys", + Kind::List, + "USER=KEY,[USER=KEY...]", + None, + "With bootstrap-users: their SSH keys, as authorized_keys lines (ssh-ed25519 <base64> [comment], named by the comment), recorded in their entries: to log in by key and sign values (docs/access.md), so a swarm can be strict from its start.", + ), + option( "log-format", Kind::Text, "auto|text|journal", @@ -572,6 +579,8 @@ pub(crate) struct Settings { #[serde(default)] pub(crate) bootstrap_users: Vec<String>, #[serde(default)] + pub(crate) bootstrap_keys: Vec<String>, + #[serde(default)] pub(crate) cors_origins: Vec<String>, #[serde(default)] pub(crate) sign_every: crate::document::signatures::SignEvery, @@ -830,6 +839,11 @@ impl Settings { { bail!("bootstrap-users: {bad:?} isn't a user name (1 to 64 of A-Z a-z 0-9 . _ @ -)"); } + if let Err(why) = + crate::access::registry::first_users(&self.bootstrap_users, &self.bootstrap_keys) + { + bail!("{why}"); + } if self.genesis && self.recover_from.is_some() { bail!("recover-from starts the swarm from a backup; it can't be combined with genesis"); } @@ -979,6 +993,7 @@ impl Settings { ("swarm-key-create", self.swarm_key_create), ("protocol-writers", !self.protocol_writers.is_empty()), ("bootstrap-users", !self.bootstrap_users.is_empty()), + ("bootstrap-keys", !self.bootstrap_keys.is_empty()), ("alias", self.alias.is_some()), ("dashboard-url", self.dashboard_url.is_some()), ("debug-api", self.debug_api), |