mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

semi-spread example: name the store's CA on the machines without the store

Browse source
This commit is contained in:
atlas 2026-11-10 18:36:40 +01:00 • committed by mara
commit 250118d558
1 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/examples/semi-spread/hive.nix
View file

@ -5,11 +5,12 @@ let
hyperhive = config.services.hyperhive;
name = lib.removePrefix "hive-" config.networking.hostName;
# The leaves for this hive, copied from swarm-central, where the secret store
# runs: `client.pem` and `client-key.pem` from
# The store's CA (`ca.pem`, from `/var/lib/swarm-bao-pki/`) and the leaves
# for this hive, copied from swarm-central, where the secret store runs:
# `client.pem` and `client-key.pem` from
# `/var/lib/swarm-bao-pki/hives/<name>/`, along with that directory's
# `hive-leaf.pem` and `hive-leaf-key.pem`, which the hive's gateway
# certificate comes from. Both pairs sit in one directory.
# certificate comes from. All of them sit in one directory.
pki = "/var/lib/swarm-pki";
in
{
@ -20,6 +21,7 @@ in
hiveName = name;
};
bao = {
serverCaFile = "${pki}/ca.pem";
clientCertFile = "${pki}/client.pem";
clientKeyFile = "${pki}/client-key.pem";
};