vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive TLS: reload the trust bundle's unit on a switch, name the missing root when it's empty

Browse source 
A switch that changed `hive-tls-ca` stopped and started it, and the stop
propagated through `Requires=` to the store's container (sealed again under
the shamir seal), every container binding the bundle, and every
`<name>-ca-bundle` unit with its consumers. `reloadIfChanged` with the same
script as `ExecReload` rewrites the bundle in place and restarts none of them.
`Requires=` stays, so a failed assembly still keeps them from starting.

With `swarm-services-root.pem` missing, `hive-tls-ca` writes an empty bundle
and every `<name>-ca-bundle` unit fails. Its log line now names the root's
path. docs/swarm/ca.md describes both.
This commit is contained in:
atlas 2026-10-05 20:47:20 +02:00 • committed by mara
commit 1a4dc16053
3 changed files with 53 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/host-modules/hive-tls.nix
View file

@ -362,6 +362,17 @@ in
# "$svcroot" ]` guard is what makes that state legal rather than fatal,
# and `swarm-services-cert` restarts this unit once the root it wrote
# is new — so the bundle converges instead of being a boot behind.
#
# ⚠️ A switch that changes this unit reloads it, running the same
# script, rather than stopping and starting it. A stop propagates to
# every unit that `Requires=` this one: the store's container, which
# comes back sealed under the `shamir` seal, every container that
# binds the bundle, and every `<name>-ca-bundle` unit with its
# consumers. A reload rewrites the bundle in place and touches none of
# them, so a `<name>-ca-bundle` unit keeps the copy it made at start
# until it restarts.
reloadIfChanged = true;
reload = config.systemd.services.hive-tls-ca.script;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
@ -387,7 +398,7 @@ in
if [ -s "$svcroot" ]; then
cat "$svcroot" > "$bundle"
else
echo "no trust anchor on disk yet — $bundle is empty until the store's root is fetched" >&2
echo "the store's root $svcroot is missing or empty, so $bundle is empty and every *-ca-bundle unit fails until swarm-services-cert fetches it" >&2
: > "$bundle"
fi
chmod 0644 "$bundle"