mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

pull swarm closures through the nix daemon: substituters in the fragment, merged root-only netrc

Browse source
This commit is contained in:
atlas 2026-11-08 10:29:46 +01:00 • committed by mara
commit ef68baa00f
1 changed files with 582 additions and 382 deletions
Download patch file Download diff file Expand all files Collapse all files

33
nix/module-eval/hive-tls.nix
View file

@ -773,7 +773,6 @@ let
&& lib.hasInfix "dir=/run/hyperhive-priv/attic" u.script
&& lib.hasInfix "install -d -m 0700 \"$dir\"" u.script
&& lib.hasInfix ''atomic_write_secret 0600 "" "$dir/public-key"'' u.script
&& lib.hasInfix ''atomic_write_secret 0600 "" "$dir/netrc"'' u.script
&& lib.hasInfix "machine attic.t.local password" u.script
&& u.environment.BAO_CLIENT_CERT == leafUnit.environment.BAO_CLIENT_CERT
&& u.environment.BAO_CLIENT_KEY == leafUnit.environment.BAO_CLIENT_KEY
@ -879,9 +878,9 @@ let
}
{
# The daemon only learns the cache from the fragment the root unit
# writes, and lists as trusted the one address from the host's
# configuration. A host with no unit has no include.
name = "the host's nix.conf includes a fragment that trusts only the swarm key, and only hive-core gets the token";
# writes, from the address in the host's configuration. A host with no
# unit has no include.
name = "the host's nix.conf includes a fragment that gives the daemon the cache, the key and a root-only netrc that keeps the host's own entries";
ok =
let
u = units.hive-priv-cache-facts;
@ -890,23 +889,21 @@ let
lib.hasInfix "!include /run/hyperhive-nix/cache.conf" allLocal.nix.extraOptions
&& !(lib.hasInfix "hyperhive-nix" noIdentity.nix.extraOptions)
&& lib.hasInfix "conf=/run/hyperhive-nix/cache.conf" u.script
&& lib.hasInfix ''fragment="extra-trusted-public-keys = $key"'' u.script
# The fragment names the cache, the key and the merged netrc.
&& lib.hasInfix "extra-substituters = https://attic.t.local/swarm" u.script
&& lib.hasInfix "extra-trusted-public-keys = $key" u.script
&& lib.hasInfix "netrc-file = $netrc_file" u.script
&& lib.hasInfix "netrc_file=/run/hyperhive-nix/netrc" u.script
&& lib.hasInfix ''atomic_write_secret 0600 "" "$netrc_file"'' u.script
&& lib.hasInfix ''atomic_write_secret 0644 "" "$conf"'' u.script
# The daemon is told no substituter and no netrc: no other client of it
# can fetch from the cache or send the token.
&& !(lib.hasInfix "extra-trusted-substituters" u.script)
&& !(lib.hasInfix "trusted-substituters" allLocal.nix.extraOptions)
&& !(lib.hasInfix "netrc-file" u.script)
# The token's one unprivileged reader is the hive-core group.
&& lib.hasInfix "client_netrc=/run/hyperhive-nix/netrc" u.script
&& lib.hasInfix ''atomic_write_secret 0640 ":hive-core" "$client_netrc"'' u.script
# The host's own netrc is merged in: nix's default path when the host sets none.
&& lib.hasInfix "host_netrc=/etc/nix/netrc" u.script
# No client copy of the token for hive-core, and hive-c0re is not told the cache.
&& !(lib.hasInfix "client_netrc" u.script)
&& !(c0re ? HIVE_C0RE_CACHE_URL)
&& lib.elem "d /run/hyperhive-nix 0755 root root - -" allLocal.systemd.tmpfiles.rules
# hive-c0re is told the address; hive-priv no longer is.
&& c0re.HIVE_C0RE_CACHE_URL == "https://attic.t.local/swarm"
&& !(noIdentity.systemd.services.hive-c0re.environment ? HIVE_C0RE_CACHE_URL)
# Control for the absences: the lookups find the units' other variables.
# Control for the absence: the lookup finds the unit's other variables.
&& c0re ? HOME
&& noIdentity.systemd.services.hive-c0re.environment ? HOME
&& allLocal.systemd.services.hive-priv.environment ? NIX_REMOTE
&& !(allLocal.systemd.services.hive-priv.environment ? HIVE_PRIV_CACHE_URL);
}