mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix trusts the swarm's root through its own CA bundle, so root's nix clients reach the cache

Browse source
This commit is contained in:
atlas 2026-11-08 18:32:37 +01:00
commit 9d62ef44b5
1 changed files with 299 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/4-implementation/trust-boundary/hive-c0re-privilege.md
View file

@ -89,10 +89,14 @@ the daemon accepts:
store identity and writes the key to `/run/hyperhive-priv/attic/public-key`
(directory `0700`, file `0600`, root). It also writes a nix.conf fragment,
`/run/hyperhive-nix/cache.conf` (`0644`), with `extra-substituters` (the
address), `extra-trusted-public-keys` (the key) and `netrc-file`, which the
host's nix.conf includes (`!include`, so a host whose unit hasn't run yet
still starts). The fragment holds no secret. `hive-priv` reads nothing from
`/run/hyperhive/attic/`, which `hive-c0re` writes for the probe.
address), `extra-trusted-public-keys` (the key), `netrc-file` and
`ssl-cert-file`, which the host's nix.conf includes (`!include`, so a host
whose unit hasn't run yet still starts). The fragment holds no secret.
`ssl-cert-file` names `/run/hyperhive-nix/ca-bundle.crt` (`0644`): the host's
own CA bundle plus the swarm's root, so nix clients on the host trust the
cache's certificate while the host's system trust stays without the root.
`hive-priv` reads nothing from `/run/hyperhive/attic/`, which `hive-c0re`
writes for the probe.
- Only root reads the token. The netrc the fragment names,
`/run/hyperhive-nix/netrc` (`root:root 0600`), holds the token's entry plus
the entries of the host's own netrc (`nix.settings.netrc-file`, else nix's