vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

render squid's users file from this hive's proxy credentials

Browse source
This commit is contained in:
atlas 2026-10-28 13:02:25 +01:00 • committed by mara
commit 52d532ff5a
1 changed files with 562 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/host-modules/hive-squid.nix
View file

@ -21,6 +21,8 @@ let
allowed = lib.unique (cfg.allowedDomains ++ [ cfg.selfcheck.canary ]);
usersDir = builtins.dirOf cfg.usersFile;
# Evaluated top to bottom, first match wins. The three destination denies
# sit before the only allow: squid resolves names on the host, so a name
# that answers 127.0.0.1, 169.254.169.254 or a bridge address would
@ -136,6 +138,17 @@ in
'';
};
usersFile = lib.mkOption {
type = lib.types.path;
default = "/var/lib/hive-squid/users";
description = ''
The `<user>:<hash>` file hive-c0re renders from the credentials in the
swarm secret store: one line per agent of this hive and one for the
self-check, as SHA-512 crypt hashes. Created empty, owned by `hive-core`
and readable by the `squid` group. Squid doesn't read it yet.
'';
};
selfcheck.canary = lib.mkOption {
type = lib.types.str;
default = hyperhiveCfg.swarm.forge.domain;
@ -167,6 +180,13 @@ in
configText = squidConf;
};
# The directory is setgid so the file hive-c0re renames into it is the
# squid group's.
systemd.tmpfiles.rules = [
"d ${usersDir} 2750 hive-core squid - -"
"f ${cfg.usersFile} 0640 hive-core squid - -"
];
systemd.services.squid = {
serviceConfig = sandbox // {
User = "squid";