vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-bao-pki: sign every other hive's three store leaves

Browse source 
The store host's `swarm-bao-pki` now also signs, for every hive in
`swarm.hives` other than its own, the reader (`<hive>`), queue-agent
(`<queueAgentCommonNamePrefix>-<hive>`) and gateway-leaf
(`<hiveLeafCommonNamePrefix>-<hive>`) leaves, into
/var/lib/swarm-bao-pki/hives/<hive>/ with the basenames the own hive's
leaves use. Same CA, same `signLeaf`, idempotent on absence like every
other leaf in the unit. `signLeaf` now takes the CA from the top of the
PKI directory rather than from the leaf's directory; every existing
caller passed that directory, so their output is unchanged.

The operator still copies the files to the other hive's host and names
them in config; only the openssl step against the CA goes away
(mara on #5016, c95685: "ok mint").

Closes #5016
This commit is contained in:
atlas 2026-10-12 19:15:23 +02:00 • committed by mara
commit 48a728df17
6 changed files with 84 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nix/module-eval/bao-grants.nix
View file

@ -1289,6 +1289,30 @@ let
t.baoHiveIdentityCertFile
!= baoGrantHere.services.hyperhive.deploy.bao.servicesIssuerClientCertFile;
}
{
# The other hives' side: every hive in the directory but this one gets
# the same three leaves, under its own name, in a directory of its own
# that the operator copies to its host.
name = "the PKI unit signs every other hive's reader, queue-agent and gateway-leaf identities";
ok =
let
s = baoGrantTwoHives.systemd.services.swarm-bao-pki.script;
b = baoGrantTwoHives.services.hyperhive.deploy.bao;
signs =
file: cn: lib.hasInfix "/hives/h2/${file}.pem ]" s && lib.hasInfix " ${cn} \"\" clientAuth" s;
in
signs "client" "h2"
&& signs "queue-agent" "${b.queueAgentCommonNamePrefix}-h2"
&& signs "hive-leaf" "${b.hiveLeafCommonNamePrefix}-h2"
# This hive's own leaves stay at the top of the directory.
&& !(lib.hasInfix "/hives/h1/" s);
}
{
# What makes the one above mean something: a hive outside the directory
# gets nothing, so a store with only its own hive signs no other set.
name = "the PKI unit signs no other hive's leaves when the directory holds only its own";
ok = !(lib.hasInfix "swarm-bao-pki/hives/" baoGrantHere.systemd.services.swarm-bao-pki.script);
}
{
name = "a gateway-leaf role prefix outside swarm-* is refused, naming the option";
ok =