vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: the gateway leaf uses the services-issuer identity, not a hive's

Browse source 
swarm-services-cert issues the swarm-services leaf a self-signed gateway
serves, and on a host fronting no swarm name fetches the store's pki root.
It is gated on the gateway, not on a hive, yet its leaf pair was named
under deploy.hive-controller.tls and defaulted from the hive reader's cert
directory, and the root fetch presented the hive's own identity. A gateway
host with no hive had no such identity, so that branch was red by
construction.

- The pair moves to deploy.bao.servicesIssuerClient{Cert,Key}File, beside
  the store's other host-unit readers, and glue-bao-tls.nix defaults it on
  the store's host from the leaf it already mints. The old
  deploy.hive-controller.tls.baoClient{Cert,Key}File paths are
  mkRenamedOptionModule aliases. glue-services-issuer-bao-identity.nix,
  which derived the default from deploy.bao.clientCertFile, is gone.
- The no-swarm-name root fetch presents the services-issuer pair. The hive
  identity is now only hive-tls-resign's.
- A self-signed gateway with no pair fails evaluation, naming both options.
  A pair named but unreadable still fails the unit, naming the paths.

Refs #4921
This commit is contained in:
atlas 2026-10-06 09:48:16 +02:00 • committed by mara
commit 5761398d60
13 changed files with 319 additions and 173 deletions
Download patch file Download diff file Expand all files Collapse all files

37
nix/host-modules/swarm-bao.nix
View file

@ -1950,6 +1950,43 @@ in
'';
};
servicesIssuerClientCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "/var/lib/swarm-bao-pki/services-issuer.pem";
description = ''
Certificate `swarm-services-cert` presents to the store: to log in and
ask for the swarm-services leaf the gateway serves, and for the
handshake of the root fetch on a host fronting no swarm name. Its
subject must be
{option}`services.hyperhive.deploy.bao.servicesIssuerCommonName`.
⚠️ Neither the reader's
{option}`services.hyperhive.deploy.bao.clientCertFile` nor a hive's own
identity: this one's policy permits `update` on
`pki/issue/swarm-services` and nothing else, and it is the same on
every gateway host, whether or not a hive runs there.
Required on every host whose gateway serves the self-signed leaf;
unset fails evaluation.
./glue-bao-tls.nix points it at the leaf it mints on the store's host.
On a gateway host without the store, it is a file the operator copies
from the store's host. A path, never a value.
'';
};
servicesIssuerClientKeyFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "/var/lib/swarm-bao-pki/services-issuer-key.pem";
description = ''
Private key for
{option}`services.hyperhive.deploy.bao.servicesIssuerClientCertFile`.
A path, never a value.
'';
};
granterCommonName = lib.mkOption {
type = lib.types.str;
default = "bao-granter";