mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix trusts the swarm's root through its own CA bundle, so root's nix clients reach the cache

Browse source
This commit is contained in:
atlas 2026-11-08 18:32:37 +01:00
commit 9d62ef44b5
1 changed files with 299 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

36
nix/host-modules/hive-priv-cache.nix
View file

@ -12,20 +12,18 @@
# - the cache's public key and the pull token are read from the store by a root
# oneshot, `hive-priv-cache-facts`, under this hive's own store identity. The
# key lands in `/run/hyperhive-priv/attic/public-key` (directory `0700`, file
# `0600`).
# The cache's address, the key and a netrc also land in a nix.conf fragment,
# `/run/hyperhive-nix/cache.conf`, as `extra-substituters`,
# `extra-trusted-public-keys` and `netrc-file`, which the host's nix.conf
# includes (`!include`, so a host whose unit has not run yet still starts).
# Every client of the daemon (hive-c0re, agent containers on `nixBuilds =
# host`) can have a swarm closure substituted; closures hold no secret;
# - that netrc, `/run/hyperhive-nix/netrc` (`root:root 0600`), is the pull
# token's entry plus the entries of the host's own netrc, which
# `netrc-file` would otherwise replace. The host's netrc is
# `nix.settings.netrc-file` when the host sets it, else nix's default
# `/etc/nix/netrc`. The unit merges again on every run, so an edit reaches the
# daemon within the timer's ten minutes. A netrc named only in
# `nix.extraOptions` is not seen.
# `0600`). The address, the key, a netrc and a CA bundle also land in a
# nix.conf fragment, `/run/hyperhive-nix/cache.conf`, as `extra-substituters`,
# `extra-trusted-public-keys`, `netrc-file` and `ssl-cert-file`, which the
# host's nix.conf includes (`!include`, so a host whose unit has not run yet
# still starts). Every nix client of the host can have a swarm closure
# substituted; the fragment holds no secret;
# - `netrc-file` and `ssl-cert-file` take one path and would replace the host's
# own, so the files they name merge it in: the pull token's entry plus the
# host's netrc entries, and the host's CA bundle plus the swarm's root, which
# the cache's certificate chains to. The host's are `nix.settings.netrc-file`
# else `/etc/nix/netrc`, and `nix.settings.ssl-cert-file` else
# `security.pki.caBundle`; one named only in `nix.extraOptions` is not seen.
#
# hive-c0re keeps its own copies under `/run/hyperhive/attic/` for the probe.
{
@ -60,6 +58,13 @@ let
netrcFile = "${confDir}/netrc";
# `netrc-file` is not additive: the fragment's setting replaces the host's.
hostNetrc = toString (config.nix.settings.netrc-file or "/etc/nix/netrc");
# `ssl-cert-file` is not additive either. The host's bundle is the one nix
# would use without the fragment: `nix.settings.ssl-cert-file` when the host
# sets it, else the system bundle the nix daemon's `CURL_CA_BUNDLE` names.
caBundleFile = "${confDir}/ca-bundle.crt";
baseBundle = toString (config.nix.settings.ssl-cert-file or config.security.pki.caBundle);
# Written by `swarm-services-cert` on a host whose gateway is self-signed.
swarmCa = "${tls.stateDir}/swarm-services-root.pem";
# Where the store runs on this host, the first login waits for its container.
# No `wants`: a pull would start the container mid-switch on the old closure.
@ -118,6 +123,9 @@ in
confFile
netrcFile
hostNetrc
caBundleFile
baseBundle
swarmCa
;
url = cacheUrl;
};