vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

nix(gateway): factor the self-signed condition into a shared option

Browse source 
Per review: the `tls.certDir == null && !tls.acme.enable` derivation was
duplicated in hive-gateway, hive-tls, and hive-ci. Expose it once as a
read-only internal option `services.hyperhive.gateway.useSelfSigned` (the
gateway module's single source of truth) and have hive-tls and hive-ci
consume it instead of re-deriving.

Eval-proven: gateway.useSelfSigned is true on the self-signed default /
false with tls.certDir, and the hive-tls (HIVE_TLS_CA_PATH) + hive-ci
(NODE_EXTRA_CA_CERTS) wiring derives correctly from it.
This commit is contained in:
atlas 2026-06-18 01:03:55 +02:00
commit 3b8e77c1c1
3 changed files with 24 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/modules/hive-tls.nix
View file

@ -13,11 +13,10 @@ let
# The host-managed hive CA is the trust anchor for self-signed mode.
# It is only stood up when the gateway actually serves a self-signed
# cert: a domain must be set (the leaf SANs derive from it) and the
# gateway must be in self-signed mode — i.e. neither an operator cert
# (`tls.certDir`) nor ACME is configured. With either of those the
# public/operator CA already validates, so the hive CA is unnecessary.
useSelfSigned = gatewayCfg.tls.certDir == null && !gatewayCfg.tls.acme.enable;
active = hyperhiveCfg.enable && useSelfSigned && domain != null;
# gateway must be in self-signed mode. The self-signed condition is the
# gateway module's single source of truth (`gateway.useSelfSigned`):
# true when neither an operator cert (`tls.certDir`) nor ACME is set.
active = hyperhiveCfg.enable && gatewayCfg.useSelfSigned && domain != null;
in
{
# Host-side TLS trust root for the self-signed gateway mode.