From 0f3da0a496a6533b77ec577ce910f89c59a3822f Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Mon, 19 Oct 2026 19:12:44 +0200
Subject: [PATCH] the CA fetch logs which trust anchor it uses for bao

---
 nix/agent-modules/hive-ca.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nix/agent-modules/hive-ca.nix b/nix/agent-modules/hive-ca.nix
index 47d875b0..94effef1 100644
--- a/nix/agent-modules/hive-ca.nix
+++ b/nix/agent-modules/hive-ca.nix
@@ -130,6 +130,9 @@ in
           cacert=
           if [ -s "$CREDENTIALS_DIRECTORY/${serverCaCredential}" ]; then
             cacert="$CREDENTIALS_DIRECTORY/${serverCaCredential}"
+            echo "trusting bao via the delivered server CA credential" >&2
+          else
+            echo "no bao server CA credential delivered; trusting the system bundle" >&2
           fi
 
           dir=/run/${runtimeDir}