mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix trusts the swarm's root through its own CA bundle, so root's nix clients reach the cache

Browse source
This commit is contained in:
atlas 2026-11-08 18:32:37 +01:00
commit 9d62ef44b5
1 changed files with 299 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

32
nix/module-eval/hive-tls.nix
View file

@ -24,6 +24,7 @@ let
;
})
hive
hiveWith
hiveWithController
runGroup
;
@ -41,16 +42,18 @@ let
# Fronting none of the swarm's names, reading a store it does not run,
# with the reader identity, the services-issuer pair and the hive's own
# identity placed by hand.
noService = hiveWithController {
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
deploy.bao.serverCaFile = "/etc/pki/bao-ca.pem";
deploy.bao.servicesIssuerClientCertFile = "/etc/pki/bao-services-issuer.pem";
deploy.bao.servicesIssuerClientKeyFile = "/etc/pki/bao-services-issuer-key.pem";
deploy.hive-controller.tls.baoHiveIdentityCertFile = "/etc/pki/bao-hive.pem";
deploy.hive-controller.tls.baoHiveIdentityKeyFile = "/etc/pki/bao-hive-key.pem";
};
# identity placed by hand, and its own `ssl-cert-file` in nix.conf.
noService = hiveWith [ { nix.settings.ssl-cert-file = "/etc/pki/host-ca.pem"; } ] (
lib.recursiveUpdate { deploy.hive-controller.enable = true; } {
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
deploy.bao.serverCaFile = "/etc/pki/bao-ca.pem";
deploy.bao.servicesIssuerClientCertFile = "/etc/pki/bao-services-issuer.pem";
deploy.bao.servicesIssuerClientKeyFile = "/etc/pki/bao-services-issuer-key.pem";
deploy.hive-controller.tls.baoHiveIdentityCertFile = "/etc/pki/bao-hive.pem";
deploy.hive-controller.tls.baoHiveIdentityKeyFile = "/etc/pki/bao-hive-key.pem";
}
);
noSvcFetch = noService.systemd.services.swarm-services-cert.script;
# The same hive holding its own identity and no services-issuer pair: the
@ -898,6 +901,15 @@ let
&& lib.hasInfix ''atomic_write_secret 0644 "" "$conf"'' u.script
# The host's own netrc is merged in: nix's default path when the host sets none.
&& lib.hasInfix "host_netrc=/etc/nix/netrc" u.script
# The fragment names the bundle: the host's own CAs plus the swarm's root, in a file of its own.
&& lib.hasInfix "ssl-cert-file = $ca_bundle_file" u.script
&& lib.hasInfix "ca_bundle_file=/run/hyperhive-nix/ca-bundle.crt" u.script
&& lib.hasInfix "swarm_ca=/var/lib/hive-tls/swarm-services-root.pem" u.script
&& lib.hasInfix ''atomic_write_secret 0644 "" "$ca_bundle_file"'' u.script
# No ssl-cert-file on the host: the system bundle is the base. A host that sets one is merged, not replaced.
&& lib.hasInfix "base_bundle=${allLocal.security.pki.caBundle}" u.script
&& lib.hasInfix "base_bundle=/etc/pki/host-ca.pem" noService.systemd.services.hive-priv-cache-facts.script
&& !(lib.hasInfix "base_bundle=${allLocal.security.pki.caBundle}" noService.systemd.services.hive-priv-cache-facts.script)
# No client copy of the token for hive-core, and hive-c0re is not told the cache.
&& !(lib.hasInfix "client_netrc" u.script)
&& !(c0re ? HIVE_C0RE_CACHE_URL)