vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

tls: a CA root change no longer restarts the store or bounces containers

Browse source
This commit is contained in:
atlas 2026-10-17 12:58:48 +02:00 • committed by mara
commit 041779d910
4 changed files with 136 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/host-modules/hive-tls.nix
View file

@ -400,9 +400,9 @@ in
#
# What that costs: the trust bundle written at the end of this script
# is the services root, so on a first boot it is written before that
# file exists and is empty until a restart. The `if [ -s
# file exists and is empty until the script runs again. The `if [ -s
# "$svcroot" ]` guard is what makes that state legal rather than fatal,
# and `swarm-services-cert` restarts this unit once the root it wrote
# and `swarm-services-cert` reloads this unit once the root it wrote
# is new — so the bundle converges instead of being a boot behind.
#
# ⚠️ A switch that changes this unit reloads it, running the same
@ -411,8 +411,8 @@ in
# comes back sealed under the `shamir` seal, every container that
# binds the bundle, and every `<name>-ca-bundle` unit with its
# consumers. A reload rewrites the bundle in place and touches none of
# them, so a `<name>-ca-bundle` unit keeps the copy it made at start
# until it restarts.
# them; each `<name>-ca-bundle` unit watches the file it is built from
# and rebuilds itself and its consumers (`lib/hive-ca-trust.nix`).
reloadIfChanged = true;
reload = config.systemd.services.hive-tls-ca.script;
serviceConfig = {
@ -637,7 +637,7 @@ in
# gateway's cert import down with it, and nginx never started at all —
# so the swarm served nothing rather than serving the wrong name. The
# bundle reaches the root the other way round, at the end of the script
# below: it restarts `hive-tls-ca` when the root CHANGED, which is the
# below: it reloads `hive-tls-ca` when the root CHANGED, which is the
# same path that already covered a store coming up hours late.
before = lib.optional gatewayWaitsForServicesLeaf "hive-gateway-self-signed-cert.service";
requiredBy = lib.optional gatewayWaitsForServicesLeaf "hive-gateway-self-signed-cert.service";
@ -726,7 +726,7 @@ in
chmod 0644 "$svcroot"
if systemctl is-active --quiet hive-tls-ca.service; then
echo "the services root changed — rebuilding the trust bundle"
systemctl restart --no-block hive-tls-ca.service
systemctl reload --no-block hive-tls-ca.service
fi
exit 0''
else
@ -896,12 +896,13 @@ in
# The bundle is assembled by `hive-tls-ca`, which runs BEFORE this
# unit — it has to, or the store's container cannot start and there
# is nothing to ask for a leaf. So on a first boot it wrote a bundle
# without the root below, and this restart is what completes it
# without the root below, and this reload is what completes it
# rather than a retry-path fallback. Only on a CHANGED root: every
# boot otherwise bounces a unit with nothing to do.
# boot otherwise reruns a unit with nothing to do. A reload, not a
# restart: a restart restarts every unit that `Requires=` it.
if [ "$rootchanged" = 1 ] && systemctl is-active --quiet hive-tls-ca.service; then
echo "the services root changed — rebuilding the trust bundle"
systemctl restart --no-block hive-tls-ca.service
systemctl reload --no-block hive-tls-ca.service
fi
'';
};