mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

semi-spread example: name the store's CA on the machines without the store

Browse source
This commit is contained in:
atlas 2026-11-10 18:36:40 +01:00 • committed by mara
commit 250118d558
4 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/2-handbook/swarm/semi-spread-deploy.md
View file

@ -170,10 +170,12 @@ addresses for you, so the key steps above go away. Three things change:
## Reading the store
Only `swarm-central` runs the secret store, and every service on the other
machines reads it with a client certificate that the store's host mints. The
example names each leaf under `/var/lib/swarm-pki/` on the machine that uses
it. After the first deploy of `swarm-central`, copy the files from
`/var/lib/swarm-bao-pki/` there over the VPN (for a hive, from
machines reads it with a client certificate that the store's host mints, and
checks the store against its CA (`ca.pem`). The example names each leaf, and
`ca.pem`, under `/var/lib/swarm-pki/` on the machine that uses it. Without
`ca.pem` the machines don't trust the store's certificate. After the first
deploy of `swarm-central`, copy the files from `/var/lib/swarm-bao-pki/` there
over the VPN (for a hive, `ca.pem` and the files from
`/var/lib/swarm-bao-pki/hives/<name>/`), then deploy the other machines. The
private keys travel over a channel you trust and stay readable by root only.
[`credentials.md`](credentials.md) lists which leaf each service reads and what

8
docs/examples/semi-spread/hive.nix
View file

@ -5,11 +5,12 @@ let
hyperhive = config.services.hyperhive;
name = lib.removePrefix "hive-" config.networking.hostName;
# The leaves for this hive, copied from swarm-central, where the secret store
# runs: `client.pem` and `client-key.pem` from
# The store's CA (`ca.pem`, from `/var/lib/swarm-bao-pki/`) and the leaves
# for this hive, copied from swarm-central, where the secret store runs:
# `client.pem` and `client-key.pem` from
# `/var/lib/swarm-bao-pki/hives/<name>/`, along with that directory's
# `hive-leaf.pem` and `hive-leaf-key.pem`, which the hive's gateway
# certificate comes from. Both pairs sit in one directory.
# certificate comes from. All of them sit in one directory.
pki = "/var/lib/swarm-pki";
in
{
@ -20,6 +21,7 @@ in
hiveName = name;
};
bao = {
serverCaFile = "${pki}/ca.pem";
clientCertFile = "${pki}/client.pem";
clientKeyFile = "${pki}/client-key.pem";
};

5
docs/examples/semi-spread/swarm-heavyduty.nix
View file

@ -3,8 +3,8 @@
let
hyperhive = config.services.hyperhive;
# Leaves copied from swarm-central, where the secret store runs. See
# swarm-services.nix for the helper's naming.
# The store's CA and the leaves, copied from swarm-central, where the secret
# store runs. See swarm-services.nix for the helper's naming.
pki = "/var/lib/swarm-pki";
pair = option: stem: {
"${option}ClientCertFile" = "${pki}/${stem}.pem";
@ -23,6 +23,7 @@ in
});
deploy.bao = lib.mergeAttrsList [
{ serverCaFile = "${pki}/ca.pem"; }
(pair "builder" "builder")
(pair "ciRunner" "ci-runner")
(pair "attic" "attic")

12
docs/examples/semi-spread/swarm-services.nix
View file

@ -4,9 +4,10 @@
let
hyperhive = config.services.hyperhive;
# The secret store runs on swarm-central, so each service here reads it with
# a leaf copied from there. `pair "grafanaOidc" "grafana-oidc"` names the
# options `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
# The secret store runs on swarm-central, so each service here checks it
# against the CA (`ca.pem`) and reads it with a leaf, both copied from there.
# `pair "grafanaOidc" "grafana-oidc"` names the options
# `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
# `grafana-oidc.pem` and `grafana-oidc-key.pem`.
pki = "/var/lib/swarm-pki";
pair = option: stem: {
@ -37,7 +38,10 @@ in
});
deploy.bao = lib.mergeAttrsList [
{ enable = false; }
{
enable = false;
serverCaFile = "${pki}/ca.pem";
}
(pair "forgePublisher" "forge-publisher")
(pair "servicesIssuer" "services-issuer")
(pair "grafanaOidc" "grafana-oidc")