vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls owns the per-host list of locally fronted service domains

Browse source
This commit is contained in:
atlas 2026-10-17 18:48:52 +02:00 • committed by mara
commit 22b9c570ba
9 changed files with 605 additions and 597 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/module-eval/bao-basics.nix
View file

@ -374,7 +374,7 @@ let
m:
builtins.elem "hive-gateway-self-signed-cert.service" m.systemd.services.swarm-services-cert.before;
in
baoPkcs11.services.hyperhive.swarm.localServiceDomains == [ "bao-ui.t.local" ]
baoPkcs11.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ "bao-ui.t.local" ]
&& baoPkcs11.systemd.services ? hive-gateway-self-signed-cert
&& !(waits baoPkcs11)
&& !(orders baoPkcs11)

2
nix/module-eval/core-toggle.nix
View file

@ -361,7 +361,7 @@ let
# vhosts are the hive leaf's, which this host still signs.
name = "a host fronting none of the swarm's service names requests no services leaf";
ok =
bare.services.hyperhive.swarm.localServiceDomains == [ ]
bare.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ ]
&& bare.services.hyperhive.swarm.serviceDomains != [ ]
&& lib.hasInfix "want_svc=0" bare.systemd.services.swarm-services-cert.script;
}

4
nix/module-eval/hive-tls.nix
View file

@ -222,7 +222,7 @@ let
# that asks the store for no leaf.
name = "a hive fronting no swarm name puts the store's pki root in its trust bundle";
ok =
noService.services.hyperhive.swarm.localServiceDomains == [ ]
noService.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ ]
&& lib.hasInfix ''"$BAO_ADDR/v1/pki/ca/pem"'' noSvcFetch
&& lib.hasInfix ''mv -f "$svcroot.new" "$svcroot"'' noSvcFetch
&& lib.hasInfix ''svcroot="$d/swarm-services-root.pem"'' noService.systemd.services.hive-tls-ca.script
@ -255,7 +255,7 @@ let
# control is the same hive with an identity, whose branch fetches.
name = "a hive fronting no swarm name with no store identity fails the unit, naming the hive identity's options";
ok =
noIdentity.services.hyperhive.swarm.localServiceDomains == [ ]
noIdentity.services.hyperhive.deploy.hive-controller.tls.localServiceDomains == [ ]
&& noIdentity.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile == null
&& !(lib.hasInfix "/v1/pki/ca/pem" noIdFetch)
&& lib.hasInfix "baoHiveIdentityCertFile (unset)" (noSvcBranch noIdFetch)

2
nix/module-eval/nats-tls.nix
View file

@ -420,7 +420,7 @@ let
&&
queueNoStore.services.nginx.virtualHosts.${natsName}.sslCertificate
== "/var/lib/swarm-nats-gateway-tls/cert.pem"
&& h.swarm.localServiceDomains == [ ]
&& h.deploy.hive-controller.tls.localServiceDomains == [ ]
&& !(lib.elem natsName h.swarm.serviceDomains)
&& !(lib.elem "hive-gateway-self-signed-cert.service" (s.swarm-services-cert.requiredBy or [ ]))
&& !(lib.hasInfix "serves swarm names only with it" s.hive-gateway-self-signed-cert.script)

2
nix/module-eval/swarm-services-switch.nix
View file

@ -500,7 +500,7 @@ let
# The store's UI alone: its nginx carries the passthrough to the
# store, so it starts on the fallback with the store sealed.
&&
store.services.hyperhive.swarm.localServiceDomains
store.services.hyperhive.deploy.hive-controller.tls.localServiceDomains
== [ store.services.hyperhive.swarm.bao.ui.domain ]
&& !(waitsForLeaf store)
# The homeserver without a hive: no hive-domain vhost at all, and the