From 0fc4600d07cf51a20b9588df982aced7c7ff464a Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 10 Jul 2026 14:17:23 +0200 Subject: [PATCH] =?UTF-8?q?fix(#2332):=20add=20After=3Dhive-tls-ca=20to=20?= =?UTF-8?q?resign=20service=20=E2=80=94=20prevent=20first-boot=20CA=20race?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On a fresh deploy Persistent=true causes the weekly timer to fire immediately. Without this ordering hive-tls-resign can race hive-tls-ca before the CA key is written, failing the resign. CA is always valid when this runs; resign is a no-op if the leaf is still within its half-life margin. Suggested by argus (review) + requested by mara. --- nix/modules/hive-tls.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix index 2e6eaaba..d8e82df7 100644 --- a/nix/modules/hive-tls.nix +++ b/nix/modules/hive-tls.nix @@ -184,6 +184,11 @@ in # its next boot will import the already-rotated leaf anyway. systemd.services.hive-tls-resign = { description = "Re-sign the gateway TLS leaf and propagate it into the gateway container"; + # hive-tls-ca must have run first so the CA key exists before we try + # to re-sign under it. On first boot `Persistent=true` on the weekly + # timer fires immediately; without this ordering the resign could race + # the CA initialisation and fail with "no such file" on the CA key. + after = [ "hive-tls-ca.service" ]; path = [ pkgs.openssl pkgs.coreutils