mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

semi-spread example: name the store's CA on the machines without the store

Browse source
This commit is contained in:
atlas 2026-11-10 18:36:40 +01:00 • committed by mara
commit 250118d558
1 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/examples/semi-spread/swarm-services.nix
View file

@ -4,9 +4,10 @@
let
hyperhive = config.services.hyperhive;
# The secret store runs on swarm-central, so each service here reads it with
# a leaf copied from there. `pair "grafanaOidc" "grafana-oidc"` names the
# options `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
# The secret store runs on swarm-central, so each service here checks it
# against the CA (`ca.pem`) and reads it with a leaf, both copied from there.
# `pair "grafanaOidc" "grafana-oidc"` names the options
# `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
# `grafana-oidc.pem` and `grafana-oidc-key.pem`.
pki = "/var/lib/swarm-pki";
pair = option: stem: {
@ -37,7 +38,10 @@ in
});
deploy.bao = lib.mergeAttrsList [
{ enable = false; }
{
enable = false;
serverCaFile = "${pki}/ca.pem";
}
(pair "forgePublisher" "forge-publisher")
(pair "servicesIssuer" "services-issuer")
(pair "grafanaOidc" "grafana-oidc")