vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move hiveName to deploy.hive-controller; only a hive host needs a name

Browse source
This commit is contained in:
atlas 2026-10-26 16:06:11 +01:00 • committed by mara
commit 0c6e8fc5a2
1 changed files with 402 additions and 215 deletions
Download patch file Download diff file Expand all files Collapse all files

43
nix/host-modules/glue-bao-tls.nix
View file

@ -41,16 +41,18 @@ let
# re-issuing every client certificate in the swarm.
pkiDir = import ./lib/bao-pki-dir.nix;
# What a reader calls itself to the store. The hive's name, because a bao
# cert-auth role matches on the CN — this is an interface, not a label.
# No fallback: `hiveName` is asserted set wherever `deploy.bao.enable` is
# (./hyperhive.nix), the same condition this file's `config` is gated on. A
# fallback here reads as a second supported spelling and there is no such
# thing.
clientCn = hyperhiveCfg.hiveName;
# The hive this host runs, if any, and what it calls itself to the store: the
# hive's name, because a bao cert-auth role matches on the CN — this is an
# interface, not a label. `hiveName` is asserted set wherever
# `deploy.hive-controller.enable` is (./hyperhive.nix), and the reader leaf
# below exists only there: a store host that runs no hive has no hive to
# name, and a fallback CN would read as a second supported spelling.
runsHive = deployCfg.hive-controller.enable;
clientCn = hyperhiveCfg.deploy.hive-controller.hiveName;
# Every other hive in the swarm directory. This host's own hive is signed
# into the top of the directory, beside the leaves its units read.
# Every other hive in the swarm directory. This host's own hive, where there
# is one, is signed into the top of the directory, beside the leaves its
# units read.
otherHives = lib.filter (h: h != clientCn) (lib.attrNames hyperhiveCfg.swarm.hives);
# $1 dir $2 basename $3 CN $4 SAN or "" $5 EKU
@ -83,15 +85,16 @@ in
serverCertFile = lib.mkDefault "${pkiDir}/server.pem";
serverKeyFile = lib.mkDefault "${pkiDir}/server-key.pem";
clientCaFile = lib.mkDefault "${pkiDir}/ca.pem";
# A reader on this host, which happens to be the host that mints. Only
# these three are what a reader elsewhere needs placed by hand; that they
# collapse to the same CA file here is a property of self-signing, not of
# the pairing.
clientCertFile = lib.mkDefault "${pkiDir}/client.pem";
clientKeyFile = lib.mkDefault "${pkiDir}/client-key.pem";
serverCaFile = lib.mkDefault "${pkiDir}/ca.pem";
# The hive's own reader on this host, which happens to be the host that
# mints. Only where a hive runs: the leaf's CN is the hive's name, and a
# store host without a hive has no reader to name. That the pair collapses
# to the same CA file as the server's here is a property of
# self-signing, not of the pairing.
clientCertFile = lib.mkIf runsHive (lib.mkDefault "${pkiDir}/client.pem");
clientKeyFile = lib.mkIf runsHive (lib.mkDefault "${pkiDir}/client-key.pem");
# 🩸 The readers below each present a leaf of their own rather than
# `client.pem` above. The leaf is what bao sees, so this pairing is the
# whole of what turns "one principal with the union of their grants" into
@ -181,8 +184,10 @@ in
# CA is a file rather than a service.
[ -s ${pkiDir}/server.pem ] || ${signLeaf} ${pkiDir} server \
${lib.escapeShellArg cfg.domain} ${lib.escapeShellArg "DNS:${cfg.domain}"} serverAuth
[ -s ${pkiDir}/client.pem ] || ${signLeaf} ${pkiDir} client \
${lib.escapeShellArg clientCn} "" clientAuth
${lib.optionalString runsHive ''
[ -s ${pkiDir}/client.pem ] || ${signLeaf} ${pkiDir} client \
${lib.escapeShellArg clientCn} "" clientAuth
''}
# Minted whether or not a controller runs here, because the case it
# serves is the one where it does not: a controller elsewhere needs a
@ -329,7 +334,7 @@ in
[ -s ${pkiDir}/forge-publisher.pem ] || ${signLeaf} ${pkiDir} forge-publisher \
${lib.escapeShellArg deployCfg.bao.forgePublisherCommonName} "" clientAuth
${lib.optionalString deployCfg.hive-controller.enable ''
${lib.optionalString runsHive ''
# This hive's gateway-leaf identity, which opens
# `pki/issue/<hiveLeafPkiRolePrefix>-<hive>` and nothing else. Its
# subject carries this hive's name, because ./swarm-bao.nix writes