vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nix(gateway): factor the self-signed condition into a shared option

Browse source 
Per review: the `tls.certDir == null && !tls.acme.enable` derivation was
duplicated in hive-gateway, hive-tls, and hive-ci. Expose it once as a
read-only internal option `services.hyperhive.gateway.useSelfSigned` (the
gateway module's single source of truth) and have hive-tls and hive-ci
consume it instead of re-deriving.

Eval-proven: gateway.useSelfSigned is true on the self-signed default /
false with tls.certDir, and the hive-tls (HIVE_TLS_CA_PATH) + hive-ci
(NODE_EXTRA_CA_CERTS) wiring derives correctly from it.
This commit is contained in:
atlas 2026-06-18 01:03:55 +02:00
commit 3b8e77c1c1
3 changed files with 24 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/modules/hive-ci.nix
View file

@ -16,7 +16,9 @@ let
# `upload-artifact`, which POSTs to the ROOT_URL-derived artifact endpoint)
# reject the chain, since Node trusts only its bundled CA bundle, not the
# system store. Trust the hive CA explicitly via NODE_EXTRA_CA_CERTS below.
useSelfSigned = gatewayCfg.tls.certDir == null && !gatewayCfg.tls.acme.enable;
# `gateway.useSelfSigned` is the gateway module's single source of truth
# for the self-signed condition (no duplicated derivation here).
useSelfSigned = gatewayCfg.useSelfSigned;
caHostPath = "${tlsCfg.stateDir}/ca.pem";
caContainerPath = "/run/hive-ca/ca.pem";

17
nix/modules/hive-gateway.nix
View file

@ -175,6 +175,23 @@ in
'';
};
useSelfSigned = lib.mkOption {
type = lib.types.bool;
internal = true;
readOnly = true;
default = useSelfSigned;
defaultText = lib.literalExpression "tls.certDir == null && !tls.acme.enable";
description = ''
Read-only derived flag: `true` when the gateway serves the
self-signed (hive-CA-signed) leaf — i.e. neither `tls.certDir` nor
`tls.acme.enable` is configured. Single source of truth for the
self-signed condition; consumed by the `hive-tls` and `hive-ci`
modules so the derivation isn't duplicated. Internal — not meant to
be set by operators (use `tls.certDir` / `tls.acme` to override the
self-signed default).
'';
};
httpsPort = lib.mkOption {
type = lib.types.port;
default = 443;

9
nix/modules/hive-tls.nix
View file

@ -13,11 +13,10 @@ let
# The host-managed hive CA is the trust anchor for self-signed mode.
# It is only stood up when the gateway actually serves a self-signed
# cert: a domain must be set (the leaf SANs derive from it) and the
# gateway must be in self-signed mode — i.e. neither an operator cert
# (`tls.certDir`) nor ACME is configured. With either of those the
# public/operator CA already validates, so the hive CA is unnecessary.
useSelfSigned = gatewayCfg.tls.certDir == null && !gatewayCfg.tls.acme.enable;
active = hyperhiveCfg.enable && useSelfSigned && domain != null;
# gateway must be in self-signed mode. The self-signed condition is the
# gateway module's single source of truth (`gateway.useSelfSigned`):
# true when neither an operator cert (`tls.certDir`) nor ACME is set.
active = hyperhiveCfg.enable && gatewayCfg.useSelfSigned && domain != null;
in
{
# Host-side TLS trust root for the self-signed gateway mode.