swarm-matrix-ctl

The rust that runs inside containers.hive-matrix, beside the homeserver.

One binary with subcommands rather than one binary per job. Running code in that container is not free: it needs its own store identity, its own cert role and its own bind mounts, and every one of those is per-container, not per-task. A second single-purpose crate would have had to duplicate that plumbing to add one action, so the next thing that has to run in here is a verb, not a new crate.

Verbs

appservice render

Mints the swarm appservice registration's tokens when absent and renders the registration tuwunel loads. Runs before the homeserver and needs no network.

appservice publish

Writes the rendered as_token to the swarm secret store for swarm-controller, when the store's copy differs.

Both are configured entirely by the MATRIX_APPSERVICE_* environment the units set — no flags. A systemd Environment= block is what a nix module can render; a command line full of paths is not.

🩸 A secret is a path, never a value

Nothing here logs, prints or interpolates a token. The one identifier this binary logs is the store path it wrote.