mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix trusts the swarm's root through its own CA bundle, so root's nix clients reach the cache

Browse source
This commit is contained in:
atlas 2026-11-08 18:32:37 +01:00
commit 9d62ef44b5
1 changed files with 299 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

35
nix/script-tests/attic-root-facts.nix
View file

@ -4,30 +4,39 @@
# ./attic-root-facts.sh.
#
# What runs is the rendered script, with the directory it writes moved into the
# test's scratch space.
# test's scratch space. `SCRIPT_HOSTCA` is the same script for a host whose nix
# sets its own `ssl-cert-file`, which becomes the base of the CA bundle.
{
pkgs,
...
}:
let
script = pkgs.writeText "attic-root-facts.sh" (
import ../host-modules/lib/attic-root-facts.nix { inherit (pkgs) lib; } {
hive = "alpha";
host = "cache.example";
dir = "@DIR@/attic";
url = "https://cache.example/swarm";
confFile = "@DIR@/nix/cache.conf";
netrcFile = "@DIR@/nix/netrc";
hostNetrc = "@DIR@/host-netrc";
}
);
render =
baseBundle:
pkgs.writeText "attic-root-facts.sh" (
import ../host-modules/lib/attic-root-facts.nix { inherit (pkgs) lib; } {
hive = "alpha";
host = "cache.example";
dir = "@DIR@/attic";
url = "https://cache.example/swarm";
confFile = "@DIR@/nix/cache.conf";
netrcFile = "@DIR@/nix/netrc";
hostNetrc = "@DIR@/host-netrc";
caBundleFile = "@DIR@/nix/ca-bundle.crt";
inherit baseBundle;
swarmCa = "@DIR@/swarm-root.pem";
}
);
in
pkgs.runCommand "hyperhive-script-test-attic-root-facts"
{
SCRIPT = script;
SCRIPT = render "@DIR@/system-bundle.crt";
SCRIPT_HOSTCA = render "@DIR@/host-ca.pem";
nativeBuildInputs = [
pkgs.coreutils
pkgs.curl
pkgs.gnugrep
pkgs.openssl
];
}
''