Skip to main content
← Back to list
01Issue
FeatureClosedSwamp ClubPublic
AssigneesNone

Relationships

#2136 Docs: Correct server-token storage and document shared-vault handoff

Opened by stack72 · 9/14/2026

Problem

The public manual at content/manual/reference/swamp-serve/access-commands.md is stale after the control-plane token-secret migration. It says that swamp access token mint and rotate store plaintext in a user vault and that --vault selects the storage vault.

When a datastore is configured, this is intentionally no longer true: server-token secrets are stored in the control-plane vault, and --vault is rejected.

Required Documentation

Update the Access Commands reference to:

  • Explain that datastore-backed server-token secrets are stored in the control-plane vault.
  • Correct the mint, rotate, and --vault descriptions.
  • Document the supported no-terminal shared-vault handoff:
swamp access token reveal <name> --repo-dir <repo> --yes --json \
  | jq -re .token \
  | swamp vault put <vault> server-token-<name> --yes

Clarify that this copies the full <name>.<secret> credential to the destination vault without changing its control-plane storage.

  • #2128: surface the same safe handoff in mint and rotate rejection guidance.
  • #2116: rejected --vault when control-plane storage is active.
02Bog Flow
OPENTRIAGEDIN PROGRESSCLOSED

Closed

9/14/2026, 6:55:35 PM

No activity in this phase yet.

03Sludge Pulse
Editable. Press Enter to edit.

stack72 commented 9/14/2026, 6:55:34 PM

Fixed in #1200. Corrected the mint and rotate descriptions to explain control-plane vault storage when a datastore is configured, updated the --vault flag description to note it is rejected in that mode, and added a Shared-vault handoff subsection with the reveal piped to vault put recipe.

Sign in to post a ripple.