vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move hiveName to deploy.hive-controller; only a hive host needs a name

Browse source
This commit is contained in:
atlas 2026-10-26 16:06:11 +01:00 • committed by mara
commit 0c6e8fc5a2
1 changed files with 402 additions and 215 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/host-modules/glue-secret-publisher-bao-identity.nix
View file

@ -9,7 +9,7 @@
# belongs here is the pairing: which host paths go to the publisher in
# authelia's container.
#
# ⚠️ Gated on the leaf existing, not on the store being enabled — the same rule
# ⚠️ Gated on a PKI directory existing, not on the store alone — the same rule
# ./glue-controller-bao-identity.nix states. A publisher on the store's own
# host is one deployment; a publisher beside a remote authelia holding a leaf
# issued out of band is another, and both want this wiring.
@ -25,11 +25,18 @@ let
deployCfg = hyperhiveCfg.deploy;
baoDeploy = deployCfg.bao;
# Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own
# path rather than repeating that file's directory literal: an operator who
# moves the PKI moves both, and the two cannot drift apart.
haveMintedPki = baoDeploy.clientCertFile != null;
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
# Where ./glue-bao-tls.nix puts the leaves. An operator's own `clientCertFile`
# names the directory when one is set (an operator who moves the PKI moves
# both, and the two cannot drift apart); on a store host that runs no hive
# there is no reader leaf to derive from, so it is the store's directory.
haveMintedPki = baoDeploy.clientCertFile != null || baoDeploy.enable;
pkiDir =
if baoDeploy.clientCertFile != null then
builtins.dirOf baoDeploy.clientCertFile
else if baoDeploy.enable then
import ./lib/bao-pki-dir.nix
else
null;
in
{
config = lib.mkIf (deployCfg.swarm-secret-publisher.enable && haveMintedPki) {