vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

render squid's users file from this hive's proxy credentials

Browse source
This commit is contained in:
atlas 2026-10-28 13:02:25 +01:00 • committed by mara
commit 52d532ff5a
1 changed files with 562 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/module-eval/hive-otel.nix
View file

@ -505,6 +505,21 @@ let
&& builtins.elem "cache deny all" lines
&& lib.last (lib.filter (l: l != "") lines) == "http_access deny all";
}
{
# The file hive-c0re renders exists, owned by it and readable by squid's
# group, from boot; hive-c0re gets its path only on a host with a store
# identity.
name = "squid's users file exists for hive-c0re to write, and hive-c0re is told where it is";
ok =
let
users = hiveOtel.services.hyperhive.squid.usersFile;
rules = hiveOtel.systemd.tmpfiles.rules;
in
users == "/var/lib/hive-squid/users"
&& builtins.elem "d /var/lib/hive-squid 2750 hive-core squid - -" rules
&& builtins.elem "f ${users} 0640 hive-core squid - -" rules
&& hiveOtelAllLocal.systemd.services.hive-c0re.environment.HIVE_SQUID_USERS_FILE == users;
}
{
name = "squid's port is open on the bridge interface and on no other";
ok =