vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats: the auth responder's store identity path is its own, not the hive's

Browse source 
glue-nats-auth-bao-identity.nix defaulted deploy.nats.authBaoClient{Cert,Key}File
to a sibling of deploy.bao.clientCertFile, which is the hive's own store
reader. That tied a swarm service to a hive identity, pointed a store host
whose reader was moved at a file nobody mints, and on a queue host without
the store that held only a placed hive reader invented a nats-auth.pem path
that passed the eval assertion and failed at runtime.

The glue is now gated on the store running on this host (deploy.bao.enable,
the condition glue-bao-tls.nix mints under) and names the directory the
minting unit writes to, shared through nix/host-modules/lib/bao-pki-dir.nix.
A queue host without the store gets no default and the eval assertion
refuses it until the responder's own leaf is named; the assertion message
now names deploy.bao.enable as where the default comes from.

On a default store host the evaluated paths are unchanged:
/var/lib/swarm-bao-pki/nats-auth{,-key}.pem.

Refs #4921
This commit is contained in:
atlas 2026-10-06 09:52:26 +02:00
commit 3c79c5eb5d
6 changed files with 72 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/host-modules/glue-bao-tls.nix
View file

@ -39,7 +39,7 @@ let
# Host-side, outside the container's tree, for the same reason the raft data
# is: `nixos-container destroy` must not take it. Losing the CA key means
# re-issuing every client certificate in the swarm.
pkiDir = "/var/lib/swarm-bao-pki";
pkiDir = import ./lib/bao-pki-dir.nix;
# What a reader calls itself to the store. The hive's name, because a bao
# cert-auth role matches on the CN — this is an interface, not a label.

19
nix/host-modules/glue-nats-auth-bao-identity.nix
View file

@ -7,9 +7,10 @@
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
# leaf. What belongs here is the pairing: which paths the responder presents.
#
# ⚠️ Gated on the leaf existing, not on the store being enabled, for the reason
# ./glue-nats-bao-identity.nix states: the hive hosting the queue need not be
# the hive hosting the store.
# ⚠️ Gated on the store running on this host, the only place the leaf is
# minted. Not on `deploy.bao.clientCertFile`, the hive's own reader: a queue
# host need not run a hive. A queue host without the store gets no default
# here; the operator places the responder's leaf and names it.
#
# Everything is `mkDefault`. An operator naming their own paths wins.
{
@ -18,17 +19,11 @@
...
}:
let
hyperhiveCfg = config.services.hyperhive;
deployCfg = hyperhiveCfg.deploy;
baoDeploy = deployCfg.bao;
# Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own path
# rather than repeating that file's directory literal.
haveMintedPki = baoDeploy.clientCertFile != null;
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
deployCfg = config.services.hyperhive.deploy;
pkiDir = import ./lib/bao-pki-dir.nix;
in
{
config = lib.mkIf (deployCfg.nats.enable && haveMintedPki) {
config = lib.mkIf (deployCfg.nats.enable && deployCfg.bao.enable) {
services.hyperhive.deploy.nats = {
authBaoClientCertFile = lib.mkDefault "${pkiDir}/nats-auth.pem";
authBaoClientKeyFile = lib.mkDefault "${pkiDir}/nats-auth-key.pem";

5
nix/host-modules/lib/bao-pki-dir.nix Normal file
View file

@ -0,0 +1,5 @@
# Where ./glue-bao-tls.nix keeps the store's own CA and the leaves it signs,
# on the host that runs the store. Shared so a glue that points a principal at
# its minted leaf names the directory the minting unit writes to, not a copy
# of it.
"/var/lib/swarm-bao-pki"

10
nix/host-modules/swarm-nats.nix
View file

@ -523,8 +523,11 @@ in
Required when `deploy.nats.enable` is set; unset fails at eval.
./glue-nats-auth-bao-identity.nix points it at the leaf
./glue-bao-tls.nix mints, where this host mints one; on any other
queue host it is a file the operator places. Set to a file that does
./glue-bao-tls.nix mints on a host that runs the store
({option}`services.hyperhive.deploy.bao.enable`); on any other queue
host it is a file the operator places. Never derived from
{option}`services.hyperhive.deploy.bao.clientCertFile`, which is the
hive's own reader. Set to a file that does
not exist, `swarm-nats-auth-secrets`, `swarm-bao-nats-auth-oidc` and
`swarm-bao-nats-callout-xkey` fail, and the queue's server does not
start without the xkey.
@ -633,7 +636,8 @@ in
The queue's callout xkey and its responder's OIDC client secret
are read from the swarm's secret store with this certificate, and
neither the server nor the responder starts without them. They
default to the leaf the store mints when it runs on this host;
default to the leaf the store mints where
services.hyperhive.deploy.bao.enable is set on this host;
elsewhere, issue a leaf whose CN is
services.hyperhive.deploy.bao.natsAuthCommonName and name it in
both options.