swarm-nats, matrix: the queue's and matrix-ctl's store identity paths are their own, not the hive's
glue-nats-bao-identity.nix and glue-matrix-ctl-bao-identity.nix defaulted
deploy.nats.baoClient{Cert,Key}File and deploy.matrix.ctlBaoClient{Cert,Key}File
to siblings of deploy.bao.clientCertFile, the hive's own store reader. That
pointed a store host whose reader was moved at files nobody mints, and on a
queue or homeserver host without the store that held a placed hive reader
invented a nats.pem / matrix-ctl.pem path beside it.
Both glues are now gated on the store running on this host
(deploy.bao.enable, the condition glue-bao-tls.nix mints under) and name the
directory the minting unit writes to, through nix/host-modules/lib/bao-pki-dir.nix.
Host shapes:
- Store host, default reader: unchanged. The evaluated paths stay
/var/lib/swarm-bao-pki/nats{,-key}.pem and
/var/lib/swarm-bao-pki/matrix-ctl{,-key}.pem, and the rendered units are
the same.
- Store host whose hive reader was moved: now gets the leaf minted there.
- Queue or homeserver host without the store, holding a hive reader and not
naming these options: no default any more. It still evaluates (neither
option has an eval assertion). swarm-bao-nats-tls exits 1 naming
deploy.nats.baoClient{Cert,Key}File when the queue's certificate is missing
or due for renewal; swarm-bao-matrix-oidc exits 1 naming
ctlBaoClient{Cert,Key}File, and the swarm appservice render/publish units
and the PKI bind mount no longer render. If that host had placed nats.pem
or matrix-ctl.pem beside its hive reader, it worked before and now needs
both options named.
- Hosts without the store and without a hive reader, and hosts naming the
options: unchanged.
Both refusals and option descriptions now say the default comes from
deploy.bao.enable.
Refs #4921
This commit is contained in:
atlas
parent
3c79c5eb5d
commit
1b18f6dcbd
8 changed files with 127 additions and 31 deletions
|
|
@ -8,10 +8,10 @@
|
|||
# leaf, because the thing that owns a private key owns issuing from it. What
|
||||
# belongs here is the pairing: which paths matrix-ctl presents.
|
||||
#
|
||||
# ⚠️ Gated on the leaf existing, not on the store being enabled — the same rule
|
||||
# ./glue-secret-publisher-bao-identity.nix states, and it bites harder here: a
|
||||
# swarm runs ONE homeserver, so the hive hosting it is the one least likely to
|
||||
# also be the hive hosting the store.
|
||||
# ⚠️ Gated on the store running on this host, the only place the leaf is
|
||||
# minted. Not on `deploy.bao.clientCertFile`, the hive's own reader. A
|
||||
# homeserver host without the store gets no default here; the operator places
|
||||
# matrix-ctl's leaf and names it.
|
||||
#
|
||||
# Everything is `mkDefault`. An operator naming their own paths wins.
|
||||
{
|
||||
|
|
@ -20,18 +20,11 @@
|
|||
...
|
||||
}:
|
||||
let
|
||||
hyperhiveCfg = config.services.hyperhive;
|
||||
deployCfg = hyperhiveCfg.deploy;
|
||||
baoDeploy = deployCfg.bao;
|
||||
|
||||
# Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own path
|
||||
# rather than repeating that file's directory literal: an operator who moves
|
||||
# the PKI moves both, and the two cannot drift apart.
|
||||
haveMintedPki = baoDeploy.clientCertFile != null;
|
||||
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
|
||||
deployCfg = config.services.hyperhive.deploy;
|
||||
pkiDir = import ./lib/bao-pki-dir.nix;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf (deployCfg.matrix.enable && haveMintedPki) {
|
||||
config = lib.mkIf (deployCfg.matrix.enable && deployCfg.bao.enable) {
|
||||
services.hyperhive.deploy.matrix = {
|
||||
ctlBaoClientCertFile = lib.mkDefault "${pkiDir}/matrix-ctl.pem";
|
||||
ctlBaoClientKeyFile = lib.mkDefault "${pkiDir}/matrix-ctl-key.pem";
|
||||
|
|
|
|||
|
|
@ -9,9 +9,10 @@
|
|||
# leaf, because the thing that owns a private key owns issuing from it. What
|
||||
# belongs here is the pairing: which paths `swarm-bao-nats-tls` presents.
|
||||
#
|
||||
# ⚠️ Gated on the leaf existing, not on the store being enabled — the same rule
|
||||
# ./glue-matrix-ctl-bao-identity.nix states: a swarm runs ONE queue, and the
|
||||
# hive hosting it need not be the hive hosting the store.
|
||||
# ⚠️ Gated on the store running on this host, the only place the leaf is
|
||||
# minted. Not on `deploy.bao.clientCertFile`, the hive's own reader: a queue
|
||||
# host need not run a hive. A queue host without the store gets no default
|
||||
# here; the operator places the queue's leaf and names it.
|
||||
#
|
||||
# Everything is `mkDefault`. An operator naming their own paths wins.
|
||||
{
|
||||
|
|
@ -20,18 +21,11 @@
|
|||
...
|
||||
}:
|
||||
let
|
||||
hyperhiveCfg = config.services.hyperhive;
|
||||
deployCfg = hyperhiveCfg.deploy;
|
||||
baoDeploy = deployCfg.bao;
|
||||
|
||||
# Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own path
|
||||
# rather than repeating that file's directory literal: an operator who moves
|
||||
# the PKI moves both, and the two cannot drift apart.
|
||||
haveMintedPki = baoDeploy.clientCertFile != null;
|
||||
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
|
||||
deployCfg = config.services.hyperhive.deploy;
|
||||
pkiDir = import ./lib/bao-pki-dir.nix;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf (deployCfg.nats.enable && haveMintedPki) {
|
||||
config = lib.mkIf (deployCfg.nats.enable && deployCfg.bao.enable) {
|
||||
services.hyperhive.deploy.nats = {
|
||||
baoClientCertFile = lib.mkDefault "${pkiDir}/nats.pem";
|
||||
baoClientKeyFile = lib.mkDefault "${pkiDir}/nats-key.pem";
|
||||
|
|
|
|||
|
|
@ -419,7 +419,11 @@ in
|
|||
No default: a module that guessed would be holding the CA opinion
|
||||
./swarm-bao.nix deliberately does not hold.
|
||||
./glue-matrix-ctl-bao-identity.nix points it at the leaf
|
||||
./glue-bao-tls.nix mints, where this host mints one.
|
||||
./glue-bao-tls.nix mints on a host that runs the store
|
||||
({option}`services.hyperhive.deploy.bao.enable`); on any other
|
||||
homeserver host it is a file the operator places. Never derived from
|
||||
{option}`services.hyperhive.deploy.bao.clientCertFile`, which is the
|
||||
hive's own reader.
|
||||
|
||||
The file and its key are bind-mounted into the container read-only.
|
||||
Co-located in the hive's filesystem and therefore readable by hive
|
||||
|
|
@ -631,7 +635,7 @@ in
|
|||
script =
|
||||
if !ctlActive then
|
||||
''
|
||||
echo "the homeserver's host has no matrix-ctl store identity, so it cannot read the homeserver's OIDC client secret: set services.hyperhive.deploy.matrix.ctlBaoClientCertFile and ctlBaoClientKeyFile" >&2
|
||||
echo "the homeserver's host has no matrix-ctl store identity, so it cannot read the homeserver's OIDC client secret: set services.hyperhive.deploy.matrix.ctlBaoClientCertFile and ctlBaoClientKeyFile (they default to the leaf the store mints only where services.hyperhive.deploy.bao.enable is set on this host)" >&2
|
||||
exit 1
|
||||
''
|
||||
else
|
||||
|
|
|
|||
|
|
@ -491,9 +491,12 @@ in
|
|||
`pki/issue/swarm-nats` and nothing else.
|
||||
|
||||
No default. ./glue-nats-bao-identity.nix points it at the leaf
|
||||
./glue-bao-tls.nix mints, where this host mints one. On a queue host
|
||||
./glue-bao-tls.nix mints on a host that runs the store
|
||||
({option}`services.hyperhive.deploy.bao.enable`). On a queue host
|
||||
without the store, it is a file the operator copies from the store's
|
||||
host.
|
||||
host. Never derived from
|
||||
{option}`services.hyperhive.deploy.bao.clientCertFile`, which is the
|
||||
hive's own reader.
|
||||
|
||||
A path, never a value.
|
||||
'';
|
||||
|
|
@ -1340,6 +1343,8 @@ in
|
|||
echo "cannot be requested from the store." >&2
|
||||
echo "Set services.hyperhive.deploy.nats.baoClient{Cert,Key}File" >&2
|
||||
echo "to a leaf the store's CA signed with CN=${baoDeploy.natsCommonName}." >&2
|
||||
echo "They default to the leaf the store mints only where" >&2
|
||||
echo "services.hyperhive.deploy.bao.enable is set on this host." >&2
|
||||
exit 1''
|
||||
else
|
||||
""
|
||||
|
|
|
|||
|
|
@ -71,6 +71,14 @@ let
|
|||
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
|
||||
};
|
||||
|
||||
# The store's host with the hive's own reader pointed somewhere else.
|
||||
matrixOnStoreHostReaderMoved = hiveWithController {
|
||||
deploy.bao.enable = true;
|
||||
deploy.matrix.enable = true;
|
||||
deploy.bao.clientCertFile = "/etc/pki/h1.pem";
|
||||
deploy.bao.clientKeyFile = "/etc/pki/h1-key.pem";
|
||||
};
|
||||
|
||||
# Did a module refuse this host, and over which option. An assertion is a
|
||||
# config VALUE until something forces it — `.config` never throws — so a
|
||||
# fixture in a state the module refuses stays evaluable and the refusal reads
|
||||
|
|
@ -243,6 +251,36 @@ let
|
|||
&& p.ctlBaoClientCertFile == "/var/lib/swarm-bao-pki/matrix-ctl.pem"
|
||||
&& p.ctlBaoClientKeyFile == "/var/lib/swarm-bao-pki/matrix-ctl-key.pem";
|
||||
}
|
||||
{
|
||||
# The hive's own reader is not matrix-ctl's identity, and no path is
|
||||
# derived from it: a homeserver host without the store that holds only
|
||||
# the hive's reader gets the secret fetch that fails naming the options,
|
||||
# like one holding nothing.
|
||||
name = "a homeserver host without the store is refused when it holds only the hive's reader";
|
||||
ok =
|
||||
let
|
||||
m = baoRemoteReaderMissingLeaves;
|
||||
u = m.systemd.services.swarm-bao-matrix-oidc;
|
||||
in
|
||||
m.services.hyperhive.deploy.matrix.ctlBaoClientCertFile == null
|
||||
&& !(u.environment ? BAO_CLIENT_CERT)
|
||||
&& lib.hasInfix "deploy.matrix.ctlBaoClientCertFile" u.script
|
||||
&& !(lib.hasInfix "bao login" u.script);
|
||||
}
|
||||
{
|
||||
# The default is the file the minting unit writes, wherever the hive's
|
||||
# own reader is pointed.
|
||||
name = "on the store's host matrix-ctl's leaf is the one minted there, not one beside the hive's reader";
|
||||
ok =
|
||||
let
|
||||
p = matrixOnStoreHostReaderMoved.services.hyperhive.deploy.matrix;
|
||||
mint = matrixOnStoreHostReaderMoved.systemd.services.swarm-bao-pki.script;
|
||||
in
|
||||
p.ctlBaoClientCertFile == "/var/lib/swarm-bao-pki/matrix-ctl.pem"
|
||||
&& p.ctlBaoClientKeyFile == "/var/lib/swarm-bao-pki/matrix-ctl-key.pem"
|
||||
&& lib.hasInfix "[ -s /var/lib/swarm-bao-pki/matrix-ctl.pem ] ||" mint
|
||||
&& lib.hasInfix "/var/lib/swarm-bao-pki matrix-ctl " mint;
|
||||
}
|
||||
{
|
||||
# 🩸 The identity separation this whole arrangement buys, stated as the
|
||||
# one thing that would silently undo it. The container gets MATRIX-CTL's
|
||||
|
|
|
|||
|
|
@ -46,6 +46,24 @@ let
|
|||
deploy.nats.autoGenerateCallout = true;
|
||||
};
|
||||
|
||||
# The store's host with the hive's own reader pointed somewhere else.
|
||||
natsOnStoreHostReaderMoved = hive {
|
||||
deploy.bao.enable = true;
|
||||
deploy.nats.enable = true;
|
||||
deploy.nats.autoGenerateCallout = true;
|
||||
deploy.bao.clientCertFile = "/etc/pki/h1.pem";
|
||||
deploy.bao.clientKeyFile = "/etc/pki/h1-key.pem";
|
||||
};
|
||||
|
||||
# A queue host holding only the hive's own store reader, placed by hand: no
|
||||
# store here, and no queue leaf named.
|
||||
queueWithHiveReaderOnly = hive {
|
||||
deploy.nats.enable = true;
|
||||
deploy.nats.autoGenerateCallout = true;
|
||||
deploy.bao.clientCertFile = "/etc/pki/h1.pem";
|
||||
deploy.bao.clientKeyFile = "/etc/pki/h1-key.pem";
|
||||
};
|
||||
|
||||
# A hive that is not the queue's host, with nothing about the queue's
|
||||
# address set by hand: what every hive but one in a multi-host swarm looks
|
||||
# like. The controller is on too, since it may run away from the queue.
|
||||
|
|
@ -215,6 +233,34 @@ let
|
|||
&& lib.hasInfix "[ -s /var/lib/swarm-bao-pki/nats.pem ]" allLocal.systemd.services.swarm-bao-pki.script
|
||||
&& lib.hasInfix "swarm-nats \"\" clientAuth" allLocal.systemd.services.swarm-bao-pki.script;
|
||||
}
|
||||
{
|
||||
# The hive's own reader is not the queue's identity, and no path is
|
||||
# derived from it: a queue host without the store that holds only the
|
||||
# hive's reader gets the leaf unit that fails naming the options, like
|
||||
# one holding nothing.
|
||||
name = "a queue host without the store is refused when it holds only the hive's reader";
|
||||
ok =
|
||||
let
|
||||
u = queueWithHiveReaderOnly.systemd.services.swarm-bao-nats-tls;
|
||||
in
|
||||
queueWithHiveReaderOnly.services.hyperhive.deploy.nats.baoClientCertFile == null
|
||||
&& !(u.environment ? BAO_CLIENT_CERT)
|
||||
&& lib.hasInfix "services.hyperhive.deploy.nats.baoClient{Cert,Key}File" u.script;
|
||||
}
|
||||
{
|
||||
# The default is the file the minting unit writes, wherever the hive's
|
||||
# own reader is pointed.
|
||||
name = "on the store's host the queue's leaf is the one minted there, not one beside the hive's reader";
|
||||
ok =
|
||||
let
|
||||
n = natsOnStoreHostReaderMoved.services.hyperhive.deploy.nats;
|
||||
mint = natsOnStoreHostReaderMoved.systemd.services.swarm-bao-pki.script;
|
||||
in
|
||||
n.baoClientCertFile == "/var/lib/swarm-bao-pki/nats.pem"
|
||||
&& n.baoClientKeyFile == "/var/lib/swarm-bao-pki/nats-key.pem"
|
||||
&& lib.hasInfix "[ -s /var/lib/swarm-bao-pki/nats.pem ] ||" mint
|
||||
&& lib.hasInfix "/var/lib/swarm-bao-pki nats " mint;
|
||||
}
|
||||
{
|
||||
name = "the server requires TLS: no allow_non_tls";
|
||||
ok = !(natsContainer.services.nats.settings ? allow_non_tls);
|
||||
|
|
|
|||
Loading…
Reference in a new issue