mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nats and bao can listen on a routable address, opt-in

Browse source
This commit is contained in:
atlas 2026-11-09 17:32:03 +01:00 • committed by mara
commit 892675628d
1 changed files with 174 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

33
nix/module-eval/bao-grants.nix
View file

@ -76,6 +76,9 @@ let
deploy.bao.enable = true;
deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
swarm.hives.h2.domain = "h2.example.org";
# The firewall opened with no address to listen on: the combination
# `deploy.bao.openFirewall` refuses.
deploy.bao.openFirewall = true;
};
# The store and the token, with no CA to trust. `mkForce` because the PKI
@ -86,6 +89,10 @@ let
deploy.bao.enable = true;
deploy.bao.bootstrapTokenFile = "/run/secrets/bao-bootstrap.token";
deploy.bao.clientCaFile = lib.mkForce null;
# An off-host listener opened in the firewall with no client CA: the
# combination `deploy.bao.openFirewall` refuses.
deploy.bao.extraListenAddresses = [ "10.0.0.1" ];
deploy.bao.openFirewall = true;
};
# The store plus every reader that used to log in as the hive. One fixture
# rather than one per reader: the claim they are *separate* principals is
@ -1695,6 +1702,32 @@ let
lib.any (a: !a.assertion && names a) baoGranterOddHiveLeafRole.assertions
&& !(lib.any (a: !a.assertion && names a) baoGrantHere.assertions);
}
{
# Control: `baoGrantHere` leaves the option off and fails no assertion
# naming it.
name = "openFirewall without a client CA is refused, naming both options";
ok =
let
names =
a:
lib.hasInfix "services.hyperhive.deploy.bao.openFirewall" a.message
&& lib.hasInfix "services.hyperhive.deploy.bao.clientCaFile" a.message;
in
lib.any (a: !a.assertion && names a) baoGrantNoClientCa.assertions
&& !(lib.any (a: !a.assertion && names a) baoGrantHere.assertions);
}
{
name = "openFirewall without an extra listen address is refused, naming both options";
ok =
let
names =
a:
lib.hasInfix "services.hyperhive.deploy.bao.openFirewall" a.message
&& lib.hasInfix "services.hyperhive.deploy.bao.extraListenAddresses" a.message;
in
lib.any (a: !a.assertion && names a) baoGrantTwoHives.assertions
&& !(lib.any (a: !a.assertion && names a) baoGrantHere.assertions);
}
{
# The granter writes pki roles through `roles/swarm-*` only, so a role
# named otherwise is refused at eval rather than 403'd at deploy.