From 4e4e9f8a60e4a8bfcd541d79caf8fb156f1e1bcc Mon Sep 17 00:00:00 2001
From: atlas <atlas@pr1ma.darkest.space>
Date: Tue, 23 Jun 2026 00:22:55 +0200
Subject: [PATCH] hive-tls: leafValidityDays default 30 (per mara: ahead of the
 ~47-day proposal)

Short-lived leaf bounds the blast radius of a key compromise. Doc notes
the renewal caveat: re-sign is activation-only today, so a hive that
stays up >30 days without a rebuild would need a periodic re-sign timer
to avoid leaf expiry (follow-up).
---
 nix/modules/hive-tls.nix | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/nix/modules/hive-tls.nix b/nix/modules/hive-tls.nix
index c50d960e..b55533d8 100644
--- a/nix/modules/hive-tls.nix
+++ b/nix/modules/hive-tls.nix
@@ -63,20 +63,22 @@ in
 
     leafValidityDays = lib.mkOption {
       type = lib.types.int;
-      default = 397;
+      default = 30;
       description = ''
-        Validity window of the gateway leaf cert in days (default 397).
-        397 is just under the 398-day CA/Browser-Forum leaf cap, so
-        browsers accept it without warning, while keeping the window
-        short enough to bound the blast radius of a leaf-key compromise.
-        The leaf is re-signed by the (stable) CA when it is missing or
-        within 30 days of expiry; because it shares the CA anchor, a
-        rotation does not disturb consumer trust. Agents and federation
-        peers validate against the CA, not browser CA/B-forum limits.
-        (The previous ~10y default was pointless given that auto-rotation
-        — and long enough to make browsers complain.) Keep this
-        comfortably above the gap between gateway rebuilds, since the
-        re-sign runs at service activation, not on a standalone timer.
+        Validity window of the gateway leaf cert in days (default 30).
+        Short-lived by design — ahead of the CA/Browser-Forum's move
+        toward ~47-day max lifetimes — which bounds the blast radius of a
+        leaf-key compromise. The leaf is re-signed by the (stable) CA
+        when it is missing or near expiry; because it shares the CA
+        anchor, a rotation does not disturb consumer trust. Agents and
+        federation peers validate against the CA, not browser CA/B-forum
+        limits. NOTE: at this short a window the re-sign must run more
+        often than the leaf lifetime. Today `hive-tls-ca` re-signs at
+        service activation (boot/rebuild) only — there is no periodic
+        re-sign timer yet — so a hive that does not reboot within the
+        validity window would let the leaf expire. Keep that in mind (or
+        add a re-sign timer) when running a hive that stays up for long
+        stretches without a rebuild.
       '';
     };
   };