vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#2332): add After=hive-tls-ca to resign service — prevent first-boot CA race

Browse source 
On a fresh deploy Persistent=true causes the weekly timer to fire
immediately. Without this ordering hive-tls-resign can race
hive-tls-ca before the CA key is written, failing the resign.
CA is always valid when this runs; resign is a no-op if the leaf
is still within its half-life margin.

Suggested by argus (review) + requested by mara.
This commit is contained in:
atlas 2026-07-10 14:17:23 +02:00 • committed by mara
commit 0fc4600d07
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/modules/hive-tls.nix
View file

@ -184,6 +184,11 @@ in
# its next boot will import the already-rotated leaf anyway.
systemd.services.hive-tls-resign = {
description = "Re-sign the gateway TLS leaf and propagate it into the gateway container";
# hive-tls-ca must have run first so the CA key exists before we try
# to re-sign under it. On first boot `Persistent=true` on the weekly
# timer fires immediately; without this ordering the resign could race
# the CA initialisation and fail with "no such file" on the CA key.
after = [ "hive-tls-ca.service" ];
path = [
pkgs.openssl
pkgs.coreutils