vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

tls: a CA root change no longer restarts the store or bounces containers

Browse source
This commit is contained in:
atlas 2026-10-17 12:58:48 +02:00 • committed by mara
commit 041779d910
4 changed files with 136 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

41
nix/module-eval/hive-tls.nix
View file

@ -460,6 +460,47 @@ let
&& lib.elem "hive-tls-ca.service" store.requires
&& lib.elem "hive-tls-ca.service" store.after;
}
{
# The same holds at runtime: a restart of the unit propagates through
# `Requires=` exactly as a switch's stop would. Both the root-only
# fetch and the issue path rebuild the bundle on a changed root.
name = "a changed services root reloads the trust bundle's unit and never restarts it";
ok =
let
reloads = lib.hasInfix "systemctl reload --no-block hive-tls-ca.service";
restarts = lib.hasInfix "restart --no-block hive-tls-ca.service";
in
reloads boot.script && !(restarts boot.script) && reloads noSvcFetch && !(restarts noSvcFetch);
}
{
# Nothing bounces a container on a root change, so a bundle unit that
# failed on an empty source has to recover by itself: a path unit on the
# bound file starts a refresh, which restarts the bundle unit and starts
# its consumers. The refresh is not `Before=` them (it would deadlock on
# its own restart) and `--no-block` keeps it from waiting. The controls
# are the bundle unit itself, still `Before=` its consumer, and a bare
# host, which has no poller and so none of its units.
name = "an in-container trust bundle rebuilds and restarts its consumers when the bound source is written";
ok =
let
bao = allLocal.containers.swarm-bao.config;
refresh = bao.systemd.services.swarm-bao-ca-bundle-refresh;
path = bao.systemd.paths.swarm-bao-ca-bundle-refresh;
bundle = bao.systemd.services.swarm-bao-ca-bundle;
in
path.pathConfig.PathChanged == "/run/hive-ca/trust-bundle.pem"
&& lib.elem "multi-user.target" path.wantedBy
&& lib.hasInfix "systemctl restart --no-block swarm-bao-ca-bundle.service" refresh.script
&& lib.hasInfix "systemctl start --no-block opentelemetry-collector.service" refresh.script
&& lib.hasInfix "cmp -s /run/hive-ca/trust-bundle.pem /run/swarm-bao-ca/anchor.pem" refresh.script
&& lib.elem "swarm-bao-ca-bundle.service" refresh.after
&& !(lib.elem "opentelemetry-collector.service" (refresh.before or [ ]))
&& lib.elem "opentelemetry-collector.service" bundle.before
&& lib.hasInfix "mv /run/swarm-bao-ca/anchor.pem.tmp /run/swarm-bao-ca/anchor.pem" bundle.script
&& allLocal.systemd.paths ? hive-c0re-ca-bundle-refresh
&& shared.bareWithController.systemd.paths ? hive-c0re-ca-bundle-refresh
&& !(shared.bareWithController.systemd.paths ? swarm-ci-metrics-ca-bundle-refresh);
}
{
# A missing root is the one case where the bundle is empty, and every
# `<name>-ca-bundle` unit fails on it; the log names the file.