mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix trusts the swarm's root through its own CA bundle, so root's nix clients reach the cache

Browse source
This commit is contained in:
atlas 2026-11-08 18:32:37 +01:00
commit 9d62ef44b5
2 changed files with 299 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/4-implementation/swarm/builder.md
View file

@ -540,7 +540,8 @@ the store under the hive's own store identity every ten minutes. It writes the
key to `/run/hyperhive-priv/attic/public-key` (`0700` directory, `0600` file)
and the nix.conf fragment `/run/hyperhive-nix/cache.conf`, which the host's
nix.conf includes, with the cache's address as `extra-substituters`, the key as
`extra-trusted-public-keys` and `netrc-file = /run/hyperhive-nix/netrc`. The
`extra-trusted-public-keys`, `netrc-file = /run/hyperhive-nix/netrc` and
`ssl-cert-file = /run/hyperhive-nix/ca-bundle.crt`. The
netrc (`root:root 0600`) holds the pull token's entry for the cache's host and
then the entries of the host's own netrc, which is `nix.settings.netrc-file`
when the host sets it and nix's default `/etc/nix/netrc` otherwise, because
@ -548,6 +549,15 @@ when the host sets it and nix's default `/etc/nix/netrc` otherwise, because
on every run, so an edit to the host's netrc reaches the daemon within ten
minutes. An entry for the cache's own host in the host's netrc gives way to the
pull token's. The unit doesn't see a netrc that the host names only in
`nix.extraOptions`. The CA bundle (`root:root 0644`) is the host's own bundle,
which is `nix.settings.ssl-cert-file` when the host sets it and
`security.pki.caBundle` otherwise, followed by the swarm's root from
`<deploy.hive-controller.tls.stateDir>/swarm-services-root.pem`. The cache's
certificate chains to that root, which no build-time bundle holds, and every
nix client of the host (the daemon, `hive-priv`, root's `nixos-rebuild`) reads
the fragment. Only nix trusts the root; the host's system trust stays as it was.
A host without the root yet gets its own bundle alone until a later run finds
it. The unit doesn't see an `ssl-cert-file` that the host names only in
`nix.extraOptions`. The cache's address is the host's
`services.hyperhive.swarm.attic.domain` and `cache`. The unit restarts
`nix-daemon` only when the fragment changed after the daemon started, which

12
docs/4-implementation/trust-boundary/hive-c0re-privilege.md
View file

@ -89,10 +89,14 @@ the daemon accepts:
store identity and writes the key to `/run/hyperhive-priv/attic/public-key`
(directory `0700`, file `0600`, root). It also writes a nix.conf fragment,
`/run/hyperhive-nix/cache.conf` (`0644`), with `extra-substituters` (the
address), `extra-trusted-public-keys` (the key) and `netrc-file`, which the
host's nix.conf includes (`!include`, so a host whose unit hasn't run yet
still starts). The fragment holds no secret. `hive-priv` reads nothing from
`/run/hyperhive/attic/`, which `hive-c0re` writes for the probe.
address), `extra-trusted-public-keys` (the key), `netrc-file` and
`ssl-cert-file`, which the host's nix.conf includes (`!include`, so a host
whose unit hasn't run yet still starts). The fragment holds no secret.
`ssl-cert-file` names `/run/hyperhive-nix/ca-bundle.crt` (`0644`): the host's
own CA bundle plus the swarm's root, so nix clients on the host trust the
cache's certificate while the host's system trust stays without the root.
`hive-priv` reads nothing from `/run/hyperhive/attic/`, which `hive-c0re`
writes for the probe.
- Only root reads the token. The netrc the fragment names,
`/run/hyperhive-nix/netrc` (`root:root 0600`), holds the token's entry plus
the entries of the host's own netrc (`nix.settings.netrc-file`, else nix's