vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs(tls): move the bundle rationale to the CA page

Browse source 
The comment block tripped the 30-line lint, and the lint was right: the
openssl chain-termination explanation had just been written into
docs/swarm/ca.md, so the comment was a second copy of it. What stays is
the part the code cannot say — the inode constraint, why the previous
anchor is not dropped here, and the set -e alternative that was
rejected.
This commit is contained in:
atlas 2026-08-05 18:49:35 +02:00 • committed by mara
commit 01680ee962
1 changed files with 14 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

42
nix/host-modules/hive-tls.nix
View file

@ -322,38 +322,24 @@ in
fi fi
# --- Trust bundle: what a consumer must TRUST, as opposed to # --- Trust bundle: what a consumer must TRUST, as opposed to
# `ca.pem`, which is what this host SIGNS with. The two were the # `ca.pem`, which is what this host SIGNS with. Why they stopped
# same file while the hive CA was self-signed, and stopped being # being the same file, and why `ca-previous.pem` stays in the set
# the same file the moment it became an intermediate: openssl # after an adoption, are in docs/swarm/ca.md. Three constraints
# refuses to end a chain at a trusted cert that isn't # the code cannot state:
# self-signed (that's what `-partial_chain` is for), so an
# agent's curl handed only `ca.pem` fails with "unable to get
# issuer certificate". Verified in both directions before this
# was written — rustls and Go accept a trusted intermediate,
# which is what makes the breakage partial and easy to miss.
# #
# Consumers therefore trust hive CA + swarm root; on a hive that # Written IN PLACE, never renamed into position — containers
# still has a self-signed CA the bundle is just that CA, so the # bind-mount this file and a bind mount follows the inode, so a
# consumer side needs no condition at all. Trusting the root is # rename leaves every consumer holding the old one.
# also the point of the hierarchy — it is what lets a peer hive
# validate without being hand-pinned.
# #
# Written IN PLACE, never renamed into position: containers bind # Dropping `ca-previous.pem` is deliberately NOT done here:
# -mount this file, and a bind mount follows the inode. A # "long enough" is a deployment fact, not a unit's call.
# rename would leave every consumer holding the old one.
# `ca-previous.pem` rides along after an adoption for the same
# reason: a consumer that has not restarted yet is still pinned to
# the old anchor, and dropping it the instant the new one exists
# would break exactly the hosts the migration was supposed to
# spare. Removing it is a deliberate later step, not this unit's
# call — "long enough" is a deployment fact.
# #
# Built as an explicit anchor ARRAY with `if` guards, not # Built as an array with `if` guards, not
# `[ -s f ] && anchors+=(f)`: under `set -e` an && list whose test # `[ -s f ] && anchors+=(f)`: under `set -e` an && list whose test
# fails IS a failing command and kills the unit, so the tidier # fails IS a failing command and kills the unit — on exactly the
# form would break precisely on the hive where the optional file # hive where the optional file is legitimately absent. The
# is legitimately absent. The `|| true` patch for that is worse — # reflexive `|| true` is worse; it also swallows a real failure to
# it would also swallow a real failure to read the hive CA. # read the hive CA.
bundle="$d/trust-bundle.pem" bundle="$d/trust-bundle.pem"
anchors=("$ca") anchors=("$ca")
if [ -s "$prev" ]; then anchors+=("$prev"); fi if [ -s "$prev" ]; then anchors+=("$prev"); fi