mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

semi-spread example: name the store's CA on the machines without the store

Browse source
This commit is contained in:
atlas 2026-11-10 18:36:40 +01:00 • committed by mara
commit 250118d558
1 changed files with 36 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/module-eval/semi-spread.nix
View file

@ -488,6 +488,20 @@ let
&& lib.all (p: lib.any (a: lib.hasSuffix "/128" a) p.allowedIPs) wg.peers
) (builtins.attrNames all);
}
{
# The store's certificate is signed by its own CA, which only the store's
# host has by default; every machine without the store names the copy.
name = "every machine without the store checks it against the CA copied from swarm-central";
ok =
lib.all (n: all.${n}.services.hyperhive.deploy.bao.serverCaFile == "/var/lib/swarm-pki/ca.pem") [
"swarm-services"
"swarm-heavyduty"
"hive-one"
"hive-two"
]
# Control: the machine with the store keeps the CA it minted.
&& central.services.hyperhive.deploy.bao.serverCaFile == "/var/lib/swarm-bao-pki/ca.pem";
}
{
name = "a hive resolves the internal names to the IPv6 addresses as well";
ok =