mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

wg-hive: derive test keys from a fixed seed so every store agrees

Browse source
This commit is contained in:
atlas 2026-11-09 15:51:10 +01:00 • committed by mara
commit 4b71bd97eb
1 changed files with 17 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

26
nix/vm-tests/wg-hive.nix
View file

@ -2,10 +2,10 @@
# Unlike ../module-eval, which only reads the rendered `networking.wireguard` # Unlike ../module-eval, which only reads the rendered `networking.wireguard`
# options, this boots both hosts and sends packets. # options, this boots both hosts and sends packets.
# #
# Keys are minted by a throwaway derivation at build time and nothing is # Keys are derived from a fixed per-host seed, so every store builds the
# committed. The module takes peer public keys as eval-time strings # same bytes and nothing is committed. The module takes peer public keys
# (`swarm.hives.<name>.wireguardPublicKey`), so they are read back from # as eval-time strings (`swarm.hives.<name>.wireguardPublicKey`), so they
# the derivation's output. # are read back from the derivation's output.
{ {
pkgs, pkgs,
self, self,
@ -13,11 +13,19 @@
let let
mkKey = mkKey =
name: name:
pkgs.runCommand "wg-hive-test-key-${name}" { nativeBuildInputs = [ pkgs.wireguard-tools ]; } '' pkgs.runCommand "wg-hive-test-key-${name}"
mkdir $out {
wg genkey > $out/private nativeBuildInputs = [
wg pubkey < $out/private > $out/public pkgs.wireguard-tools
''; pkgs.openssl
];
}
''
# Test-only key: base64 of sha256(seed); wg clamps the scalar itself.
mkdir $out
printf '%s' 'hyperhive-wg-hive-test-${name}' | openssl dgst -sha256 -binary | base64 > $out/private
wg pubkey < $out/private > $out/public
'';
keys = { keys = {
h1 = mkKey "h1"; h1 = mkKey "h1";
h2 = mkKey "h2"; h2 = mkKey "h2";