28 lines
923 B
Nix
28 lines
923 B
Nix
# A hive. Identical on hive-one and hive-two: the machine `hive-<name>` runs the
|
|
# hive `<name>`.
|
|
{ config, lib, ... }:
|
|
let
|
|
# The leaves for this hive, copied from swarm-central, where the secret store
|
|
# runs: `client.pem` and `client-key.pem` from
|
|
# `/var/lib/swarm-bao-pki/hives/<name>/`, along with that directory's
|
|
# `hive-leaf.pem` and `hive-leaf-key.pem`, which the hive's gateway
|
|
# certificate comes from. Both pairs sit in one directory.
|
|
pki = "/var/lib/swarm-pki";
|
|
in
|
|
{
|
|
services.hyperhive.deploy = {
|
|
hive-controller = {
|
|
enable = true;
|
|
hiveName = lib.removePrefix "hive-" config.networking.hostName;
|
|
};
|
|
bao = {
|
|
clientCertFile = "${pki}/client.pem";
|
|
clientKeyFile = "${pki}/client-key.pem";
|
|
};
|
|
};
|
|
|
|
# The dashboard is reachable over the VPN only.
|
|
networking.firewall.interfaces.wg0.allowedTCPPorts = [
|
|
config.services.hyperhive.gateway.httpsPort
|
|
];
|
|
}
|