vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-gateway: nginx Requires= cert oneshot (fixes #856 from #848)

Browse source
This commit is contained in:
damocles 2026-05-31 17:32:34 +02:00 • committed by mara
commit 50a1eb41cf
1 changed files with 13 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/modules/hive-gateway.nix
View file

@ -404,20 +404,23 @@ in
system.stateVersion = "26.05"; system.stateVersion = "26.05";
# Generate a self-signed cert on first boot if missing. nginx # Generate a self-signed cert on first boot if missing. nginx
# waits on this (Before=) so we never start with a broken # `Requires=` this via `requiredBy`, so systemd refuses to
# ssl_certificate path. Cert covers the bare hive domain plus # start nginx until the cert exists — `before=` alone wasn't
# `*.${hyperhiveDomain}` so the matrix + forge sub-domains # enough (it only orders within a single transaction, but
# are valid under the same cert. See `docs/gateway.md` # nginx was being pulled into a different transaction by
# ("Self-signed TLS"). # multi-user.target and started without waiting, #856). Cert
# covers the bare hive domain plus `*.${hyperhiveDomain}` so
# the matrix + forge sub-domains are valid under the same
# cert. See `docs/gateway.md` ("Self-signed TLS").
systemd.services.hive-gateway-self-signed-cert = lib.mkIf cfg.selfSignedTls { systemd.services.hive-gateway-self-signed-cert = lib.mkIf cfg.selfSignedTls {
description = "Generate self-signed TLS cert for hive-gateway"; description = "Generate self-signed TLS cert for hive-gateway";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
before = [ "nginx.service" ]; before = [ "nginx.service" ];
requiredBy = [ "nginx.service" ];
unitConfig.ConditionPathExists = "!${tlsCert}"; unitConfig.ConditionPathExists = "!${tlsCert}";
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
UMask = "0077";
}; };
path = [ path = [
pkgs.openssl pkgs.openssl
@ -436,6 +439,10 @@ in
in in
'' ''
mkdir -p ${tlsDir} mkdir -p ${tlsDir}
# 0755 dir so nginx (master starts as root but workers
# drop to the nginx user) can read the cert path
# without traversal failures. Key stays 0600 below.
chmod 0755 ${tlsDir}
openssl req -x509 -newkey rsa:4096 -nodes -sha256 -days 3650 \ openssl req -x509 -newkey rsa:4096 -nodes -sha256 -days 3650 \
-keyout ${tlsKey} \ -keyout ${tlsKey} \
-out ${tlsCert} \ -out ${tlsCert} \