vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

render squid's users file from this hive's proxy credentials

Browse source
This commit is contained in:
atlas 2026-10-28 13:02:25 +01:00 • committed by mara
commit 52d532ff5a
3 changed files with 562 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/hive-c0re/default.nix
View file

@ -347,7 +347,11 @@ in
# needs access to the rest of c0re's state — that separation
# means c0re itself needs an explicit carve-out to write there.
ProtectSystem = "strict";
ReadWritePaths = [ "/var/lib/hive-gateway/conf" ];
# `-` so a host without the squid users directory still starts the daemon.
ReadWritePaths = [
"/var/lib/hive-gateway/conf"
"-${builtins.dirOf config.services.hyperhive.squid.usersFile}"
];
ProtectKernelTunables = true; # no sysctl writes
ProtectKernelLogs = true; # no /dev/kmsg access needed
ProtectControlGroups = true; # cgroup writes go through hive-priv, not c0re directly

3
nix/host-modules/hive-c0re/environment.nix
View file

@ -271,6 +271,9 @@ in
# See the LoadCredential in ./default.nix.
BAO_CLIENT_CERT = "%d/bao-client.pem";
BAO_CLIENT_KEY = "%d/bao-client-key.pem";
# Where `workers::squid_users` renders the hashes of this hive's agents' proxy
# credentials for squid; it reads them from the store under the identity above.
HIVE_SQUID_USERS_FILE = config.services.hyperhive.squid.usersFile;
}
// lib.optionalAttrs (haveBaoClientIdentity && baoDeploy.serverCaFile != null) {
# Absent means the system trust store — right for a deployment with a real

20
nix/host-modules/hive-squid.nix
View file

@ -21,6 +21,8 @@ let
allowed = lib.unique (cfg.allowedDomains ++ [ cfg.selfcheck.canary ]);
usersDir = builtins.dirOf cfg.usersFile;
# Evaluated top to bottom, first match wins. The three destination denies
# sit before the only allow: squid resolves names on the host, so a name
# that answers 127.0.0.1, 169.254.169.254 or a bridge address would
@ -136,6 +138,17 @@ in
'';
};
usersFile = lib.mkOption {
type = lib.types.path;
default = "/var/lib/hive-squid/users";
description = ''
The `<user>:<hash>` file hive-c0re renders from the credentials in the
swarm secret store: one line per agent of this hive and one for the
self-check, as SHA-512 crypt hashes. Created empty, owned by `hive-core`
and readable by the `squid` group. Squid doesn't read it yet.
'';
};
selfcheck.canary = lib.mkOption {
type = lib.types.str;
default = hyperhiveCfg.swarm.forge.domain;
@ -167,6 +180,13 @@ in
configText = squidConf;
};
# The directory is setgid so the file hive-c0re renames into it is the
# squid group's.
systemd.tmpfiles.rules = [
"d ${usersDir} 2750 hive-core squid - -"
"f ${cfg.usersFile} 0640 hive-core squid - -"
];
systemd.services.squid = {
serviceConfig = sandbox // {
User = "squid";