From 4b71bd97ebb14f6249a4a9402590da7df40361ec Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Mon, 9 Nov 2026 15:51:10 +0100
Subject: [PATCH] wg-hive: derive test keys from a fixed seed so every store
 agrees

---
 nix/vm-tests/wg-hive.nix | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/nix/vm-tests/wg-hive.nix b/nix/vm-tests/wg-hive.nix
index a5dfcbfc3..44b3c44d4 100644
--- a/nix/vm-tests/wg-hive.nix
+++ b/nix/vm-tests/wg-hive.nix
@@ -2,10 +2,10 @@
 # Unlike ../module-eval, which only reads the rendered `networking.wireguard`
 # options, this boots both hosts and sends packets.
 #
-# Keys are minted by a throwaway derivation at build time and nothing is
-# committed. The module takes peer public keys as eval-time strings
-# (`swarm.hives.<name>.wireguardPublicKey`), so they are read back from
-# the derivation's output.
+# Keys are derived from a fixed per-host seed, so every store builds the
+# same bytes and nothing is committed. The module takes peer public keys
+# as eval-time strings (`swarm.hives.<name>.wireguardPublicKey`), so they
+# are read back from the derivation's output.
 {
   pkgs,
   self,
@@ -13,11 +13,19 @@
 let
   mkKey =
     name:
-    pkgs.runCommand "wg-hive-test-key-${name}" { nativeBuildInputs = [ pkgs.wireguard-tools ]; } ''
-      mkdir $out
-      wg genkey > $out/private
-      wg pubkey < $out/private > $out/public
-    '';
+    pkgs.runCommand "wg-hive-test-key-${name}"
+      {
+        nativeBuildInputs = [
+          pkgs.wireguard-tools
+          pkgs.openssl
+        ];
+      }
+      ''
+        # Test-only key: base64 of sha256(seed); wg clamps the scalar itself.
+        mkdir $out
+        printf '%s' 'hyperhive-wg-hive-test-${name}' | openssl dgst -sha256 -binary | base64 > $out/private
+        wg pubkey < $out/private > $out/public
+      '';
   keys = {
     h1 = mkKey "h1";
     h2 = mkKey "h2";