vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls owns the per-host list of locally fronted service domains

Browse source
This commit is contained in:
atlas 2026-10-17 18:48:52 +02:00 • committed by mara
commit 22b9c570ba
9 changed files with 605 additions and 597 deletions
Download patch file Download diff file Expand all files Collapse all files

1155
nix/host-modules/hive-tls.nix
View file

File diff suppressed because it is too large Load diff

2
nix/host-modules/swarm-bao.nix
View file

@ -2470,7 +2470,7 @@ in
every gateway host, whether or not a hive runs there.
Required on every self-signed gateway host that fronts a swarm-service
name ({option}`services.hyperhive.swarm.localServiceDomains` not
name ({option}`services.hyperhive.deploy.hive-controller.tls.localServiceDomains` not
empty). Unset there, the host evaluates and `swarm-services-cert`
fails, naming both options. A host fronting none only fetches the
store's root, presenting

27
nix/host-modules/swarm.nix
View file

@ -90,7 +90,7 @@ let
# Every name is listed whether or not this host runs the service: the
# store's issuing role is built from this list on the store's host and
# has to admit a leaf for any gateway in the swarm. What one gateway's
# leaf carries is `localServiceDomains`.
# leaf carries is `deploy.hive-controller.tls.localServiceDomains`.
#
# Membership is also what `gateway.lib.tlsFor` consults to pick the
# services leaf over the hive one, so a gateway-published swarm name
@ -278,27 +278,6 @@ in
'';
};
options.services.hyperhive.swarm.localServiceDomains = lib.mkOption {
type = lib.types.listOf lib.types.str;
readOnly = true;
internal = true;
description = ''
Read-only: the names in `serviceDomains` **this host actually
fronts**, which is what its services leaf may carry. The swarm-wide
set stays what the sub-CA is name-constrained to and what the
store's issuing role permits; narrowing the leaf is what stops a
private key on one gateway presenting a valid certificate for
services that host does not serve and never has.
Read off the rendered `services.nginx.virtualHosts` rather than off
the per-service deploy flags: those flags are what the vhosts are
already guarded on, so a second reading of them is a copy that
drifts from the thing it claims to describe. Filtering
`serviceDomains` rather than assembling a list beside it is that
option's own constraint, and it applies here for the same reason.
'';
};
config = {
# Total on a null `swarm.domain` for the reason `hives.<name>.domain`'s
# default gives.
@ -317,10 +296,6 @@ in
lib.unique (lib.filter (d: d != null && d != "") serviceDomains')
);
services.hyperhive.swarm.localServiceDomains = lib.filter (
d: config.services.nginx.virtualHosts ? ${d}
) swarmCfg.serviceDomains;
assertions = [
{
# An EMPTY `hives` fires this too, deliberately: since

2
nix/module-eval/bao-basics.nix
View file

@ -374,7 +374,7 @@ let
m:
builtins.elem "hive-gateway-self-signed-cert.service" m.systemd.services.swarm-services-cert.before;
in
baoPkcs11.services.hyperhive.swarm.localServiceDomains == [ "bao-ui.t.local" ]
baoPkcs11.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ "bao-ui.t.local" ]
&& baoPkcs11.systemd.services ? hive-gateway-self-signed-cert
&& !(waits baoPkcs11)
&& !(orders baoPkcs11)

2
nix/module-eval/core-toggle.nix
View file

@ -361,7 +361,7 @@ let
# vhosts are the hive leaf's, which this host still signs.
name = "a host fronting none of the swarm's service names requests no services leaf";
ok =
bare.services.hyperhive.swarm.localServiceDomains == [ ]
bare.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ ]
&& bare.services.hyperhive.swarm.serviceDomains != [ ]
&& lib.hasInfix "want_svc=0" bare.systemd.services.swarm-services-cert.script;
}

4
nix/module-eval/hive-tls.nix
View file

@ -222,7 +222,7 @@ let
# that asks the store for no leaf.
name = "a hive fronting no swarm name puts the store's pki root in its trust bundle";
ok =
noService.services.hyperhive.swarm.localServiceDomains == [ ]
noService.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ ]
&& lib.hasInfix ''"$BAO_ADDR/v1/pki/ca/pem"'' noSvcFetch
&& lib.hasInfix ''mv -f "$svcroot.new" "$svcroot"'' noSvcFetch
&& lib.hasInfix ''svcroot="$d/swarm-services-root.pem"'' noService.systemd.services.hive-tls-ca.script
@ -255,7 +255,7 @@ let
# control is the same hive with an identity, whose branch fetches.
name = "a hive fronting no swarm name with no store identity fails the unit, naming the hive identity's options";
ok =
noIdentity.services.hyperhive.swarm.localServiceDomains == [ ]
noIdentity.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ ]
&& noIdentity.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile == null
&& !(lib.hasInfix "/v1/pki/ca/pem" noIdFetch)
&& lib.hasInfix "baoHiveIdentityCertFile (unset)" (noSvcBranch noIdFetch)

2
nix/module-eval/nats-tls.nix
View file

@ -420,7 +420,7 @@ let
&&
queueNoStore.services.nginx.virtualHosts.${natsName}.sslCertificate
== "/var/lib/swarm-nats-gateway-tls/cert.pem"
&& h.swarm.localServiceDomains == [ ]
&& h.deploy.hive-controller.tls.localServiceDomains == [ ]
&& !(lib.elem natsName h.swarm.serviceDomains)
&& !(lib.elem "hive-gateway-self-signed-cert.service" (s.swarm-services-cert.requiredBy or [ ]))
&& !(lib.hasInfix "serves swarm names only with it" s.hive-gateway-self-signed-cert.script)

2
nix/module-eval/swarm-services-switch.nix
View file

@ -500,7 +500,7 @@ let
# The store's UI alone: its nginx carries the passthrough to the
# store, so it starts on the fallback with the store sealed.
&&
store.services.hyperhive.swarm.localServiceDomains
store.services.hyperhive.deploy.hive-controller.tls.localServiceDomains
== [ store.services.hyperhive.swarm.bao.ui.domain ]
&& !(waitsForLeaf store)
# The homeserver without a hive: no hive-domain vhost at all, and the