pub const SYSTEMD_CREDENTIAL: &str = "runner-manager.user-access-token";Expand description
The name of the systemd credential the Linux machine-scoped store reads before it reads its own file.
05-infrastructure.md puts the Linux machine store at “0600 file plus
systemd credentials”, and the second half is a read path rather than a
write path: systemd decrypts a credential into a private ramfs at
$CREDENTIALS_DIRECTORY and mounts it read-only, so a service given
LoadCredentialEncrypted= gets the value without the file ever being
readable by anything but that unit. A store that ignored it would oblige an
operator who had set one up to keep a second plaintext copy on disk.