hecate_om_identity (hecate_om v0.14.2)
View SourceLoads the service-principal cert at boot and a Macula SDK client handle. Held in a gen_server so every other process can borrow the pool through hecate_om:macula_client/0.
Each hecate-service has its OWN realm-signed credential (NOT a user's). The credential lives at /etc/hecate/secrets/service-cert.pem inside the container; the host mounts the per-service directory from /etc/hecate/secrets/<service-name>/ onto that path.
v1: long-lived realm-signed cert provisioned out-of-band by a realm-admin script. v2: short-lived UCAN auto-rotated from a realm HTTP endpoint. The v2 swap-in lands here without touching consumers.
Connect-degradation: when seeds aren't reachable (early boot, test harness, no station nearby), macula_client/0 returns {error, no_client} and consumers should fall back to no-op behaviour. The service stays up; it just doesn't talk to the mesh.
Summary
Functions
The cert chain to embed in advertisements: this service's leaf cert followed by its org CA (PEM). {error, no_cert_chain} when either half is missing — the service then advertises without a chain and is reachable only by open-mode consumers (Slice 7c Direction B).
The service's stable signing keypair, or {error, no_keypair} when running on an ephemeral identity. Callers that sign DHT records degrade to no-op on the error.
This service's org name (the <org> segment of its procedure URIs). Always a binary; <<"_">> when unconfigured.
The realm CA a verifying consumer trusts as the direct-dial trust anchor (PEM). {error, no_realm_ca} when unconfigured — a verify => true call then cannot verify and drops every provider.
Functions
-spec cert_chain() -> {ok, binary()} | {error, no_cert_chain}.
The cert chain to embed in advertisements: this service's leaf cert followed by its org CA (PEM). {error, no_cert_chain} when either half is missing — the service then advertises without a chain and is reachable only by open-mode consumers (Slice 7c Direction B).
-spec keypair() -> {ok, macula_identity:key_pair()} | {error, no_keypair}.
The service's stable signing keypair, or {error, no_keypair} when running on an ephemeral identity. Callers that sign DHT records degrade to no-op on the error.
-spec org() -> binary().
This service's org name (the <org> segment of its procedure URIs). Always a binary; <<"_">> when unconfigured.
-spec realm_ca() -> {ok, binary()} | {error, no_realm_ca}.
The realm CA a verifying consumer trusts as the direct-dial trust anchor (PEM). {error, no_realm_ca} when unconfigured — a verify => true call then cannot verify and drops every provider.