vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move hiveName to deploy.hive-controller; only a hive host needs a name

Browse source
This commit is contained in:
atlas 2026-10-26 16:06:11 +01:00 • committed by mara
commit 0c6e8fc5a2
37 changed files with 402 additions and 215 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/glue-controller-bao-identity.nix
View file

@ -9,10 +9,10 @@
# second signer would duplicate that file's `openssl` helper to no benefit.
# What belongs here is the pairing: which paths this host's controller reads.
#
# ⚠️ Gated on the leaf existing, not on the store being enabled. A controller
# on the store's own host is one deployment; a controller three networks away
# holding a leaf issued out of band is another, and both want the same wiring.
# `deploy.bao.enable` would have made the first one the only supported shape.
# ⚠️ Gated on a PKI directory existing (the store runs here, or the operator
# named a reader leaf), not on the store alone. A controller on the store's own
# host is one deployment; a controller three networks away holding a leaf
# issued out of band is another, and both want the same wiring.
#
# Everything is `mkDefault`. An operator naming their own paths wins.
{
@ -25,11 +25,18 @@ let
deployCfg = hyperhiveCfg.deploy;
baoDeploy = deployCfg.bao;
# Where ./glue-bao-tls.nix puts the leaves. Derived from the reader's own
# path rather than repeating that file's directory literal: an operator who
# moves the PKI moves both, and the two cannot drift apart.
haveMintedPki = baoDeploy.clientCertFile != null;
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
# Where ./glue-bao-tls.nix puts the leaves. An operator's own `clientCertFile`
# names the directory when one is set (an operator who moves the PKI moves
# both, and the two cannot drift apart); on a store host that runs no hive
# there is no reader leaf to derive from, so it is the store's directory.
haveMintedPki = baoDeploy.clientCertFile != null || baoDeploy.enable;
pkiDir =
if baoDeploy.clientCertFile != null then
builtins.dirOf baoDeploy.clientCertFile
else if baoDeploy.enable then
import ./lib/bao-pki-dir.nix
else
null;
in
{
config = lib.mkIf (deployCfg.swarm-controller.enable && haveMintedPki) {