42 lines
1.3 KiB
Nix
42 lines
1.3 KiB
Nix
# A hive. Identical on hive-one and hive-two: the machine `hive-<name>` runs the
|
|
# hive `<name>`.
|
|
{ config, lib, ... }:
|
|
let
|
|
hyperhive = config.services.hyperhive;
|
|
name = lib.removePrefix "hive-" config.networking.hostName;
|
|
|
|
# The leaves for this hive, copied from swarm-central, where the secret store
|
|
# runs: `client.pem` and `client-key.pem` from
|
|
# `/var/lib/swarm-bao-pki/hives/<name>/`, along with that directory's
|
|
# `hive-leaf.pem` and `hive-leaf-key.pem`, which the hive's gateway
|
|
# certificate comes from. Both pairs sit in one directory.
|
|
pki = "/var/lib/swarm-pki";
|
|
in
|
|
{
|
|
services.hyperhive = {
|
|
deploy = {
|
|
hive-controller = {
|
|
enable = true;
|
|
hiveName = name;
|
|
};
|
|
bao = {
|
|
clientCertFile = "${pki}/client.pem";
|
|
clientKeyFile = "${pki}/client-key.pem";
|
|
};
|
|
};
|
|
|
|
# The hive's dashboard and its domain answer on the private addresses only.
|
|
gateway.vhosts =
|
|
lib.genAttrs
|
|
[
|
|
hyperhive.swarm.dashboardDomains.${name}
|
|
hyperhive.swarm.hives.${name}.domain
|
|
]
|
|
(_: {
|
|
public = false;
|
|
});
|
|
};
|
|
|
|
# The dashboard is reachable over the VPN only.
|
|
networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.gateway.httpsPort ];
|
|
}
|