mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

semi-spread example: name the store's CA on the machines without the store

Browse source
This commit is contained in:
atlas 2026-11-10 18:36:40 +01:00 • committed by mara
commit 250118d558
3 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/examples/semi-spread/hive.nix
View file

@ -5,11 +5,12 @@ let
hyperhive = config.services.hyperhive;
name = lib.removePrefix "hive-" config.networking.hostName;
# The leaves for this hive, copied from swarm-central, where the secret store
# runs: `client.pem` and `client-key.pem` from
# The store's CA (`ca.pem`, from `/var/lib/swarm-bao-pki/`) and the leaves
# for this hive, copied from swarm-central, where the secret store runs:
# `client.pem` and `client-key.pem` from
# `/var/lib/swarm-bao-pki/hives/<name>/`, along with that directory's
# `hive-leaf.pem` and `hive-leaf-key.pem`, which the hive's gateway
# certificate comes from. Both pairs sit in one directory.
# certificate comes from. All of them sit in one directory.
pki = "/var/lib/swarm-pki";
in
{
@ -20,6 +21,7 @@ in
hiveName = name;
};
bao = {
serverCaFile = "${pki}/ca.pem";
clientCertFile = "${pki}/client.pem";
clientKeyFile = "${pki}/client-key.pem";
};

5
docs/examples/semi-spread/swarm-heavyduty.nix
View file

@ -3,8 +3,8 @@
let
hyperhive = config.services.hyperhive;
# Leaves copied from swarm-central, where the secret store runs. See
# swarm-services.nix for the helper's naming.
# The store's CA and the leaves, copied from swarm-central, where the secret
# store runs. See swarm-services.nix for the helper's naming.
pki = "/var/lib/swarm-pki";
pair = option: stem: {
"${option}ClientCertFile" = "${pki}/${stem}.pem";
@ -23,6 +23,7 @@ in
});
deploy.bao = lib.mergeAttrsList [
{ serverCaFile = "${pki}/ca.pem"; }
(pair "builder" "builder")
(pair "ciRunner" "ci-runner")
(pair "attic" "attic")

12
docs/examples/semi-spread/swarm-services.nix
View file

@ -4,9 +4,10 @@
let
hyperhive = config.services.hyperhive;
# The secret store runs on swarm-central, so each service here reads it with
# a leaf copied from there. `pair "grafanaOidc" "grafana-oidc"` names the
# options `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
# The secret store runs on swarm-central, so each service here checks it
# against the CA (`ca.pem`) and reads it with a leaf, both copied from there.
# `pair "grafanaOidc" "grafana-oidc"` names the options
# `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
# `grafana-oidc.pem` and `grafana-oidc-key.pem`.
pki = "/var/lib/swarm-pki";
pair = option: stem: {
@ -37,7 +38,10 @@ in
});
deploy.bao = lib.mergeAttrsList [
{ enable = false; }
{
enable = false;
serverCaFile = "${pki}/ca.pem";
}
(pair "forgePublisher" "forge-publisher")
(pair "servicesIssuer" "services-issuer")
(pair "grafanaOidc" "grafana-oidc")