From 5d26908c6f446ea241a58ea49c2b41d9eb9a0463 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Sun, 4 Oct 2026 15:49:31 +0200
Subject: [PATCH] hive-tls: correct two comments that still describe a
 runtime-generated hive CA

swarm-controller.nix said the gateway leaf is signed by a hive CA generated
at runtime; lib/hive-ca-trust.nix said hive-tls-ca generates the CA and that
containers bind ca.pem, while the code binds trust-bundle.pem.

Refs #4588
---
 nix/host-modules/lib/hive-ca-trust.nix | 11 ++++++-----
 nix/host-modules/swarm-controller.nix  | 14 +++++++-------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/nix/host-modules/lib/hive-ca-trust.nix b/nix/host-modules/lib/hive-ca-trust.nix
index 37443f5a..c90a8c5e 100644
--- a/nix/host-modules/lib/hive-ca-trust.nix
+++ b/nix/host-modules/lib/hive-ca-trust.nix
@@ -1,10 +1,11 @@
 # Shared hive-CA trust plumbing for containers that must trust the
 # self-signed gateway/forge leaf for *outbound* TLS (webhook delivery,
-# CI artifact upload, …). The hive CA is generated at runtime by the host
-# `hive-tls-ca.service` (see `hive-tls.nix`) — it can't be baked into a
-# derivation — so each such container binds the public `ca.pem` read-only
-# and orders its `container@<name>` unit after `hive-tls-ca.service` so the
-# bind source exists before nspawn sets the mount up.
+# CI artifact upload, …). The anchors exist only at runtime — the host
+# `hive-tls-ca.service` (see `hive-tls.nix`) assembles them into
+# `trust-bundle.pem` — so they can't be baked into a derivation. Each such
+# container binds that bundle read-only and orders its `container@<name>`
+# unit after `hive-tls-ca.service` so the bind source exists before nspawn
+# sets the mount up.
 #
 # `bindMount` + `containerOrdering` are the language-agnostic half. The
 # *consumption* differs per runtime: an additive variable (Node's
diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix
index ae577574..cd788f6c 100644
--- a/nix/host-modules/swarm-controller.nix
+++ b/nix/host-modules/swarm-controller.nix
@@ -146,13 +146,13 @@ let
   matrixCfg = config.services.hyperhive.swarm.matrix;
 
   # The controller's forge client speaks TLS to `https://${forgeCfg.domain}`,
-  # which the gateway serves with a leaf signed by the hive CA — a CA
-  # generated at runtime, so nothing build-time can name it and it is not in
-  # the system store. `reqwest`/`rustls` resolves roots through
-  # `rustls-native-certs`, whose `SSL_CERT_FILE` *replaces* that store rather
-  # than adding to it, so without the assembled bundle every forge call fails
-  # `invalid peer certificate: UnknownIssuer` and agent creation dies at its
-  # first step.
+  # which the gateway serves with a leaf issued by the secret store's `pki`
+  # mount, whose root is generated inside the store at runtime, so nothing
+  # build-time can name it and it is not in the system store.
+  # `reqwest`/`rustls` resolves roots through `rustls-native-certs`, whose
+  # `SSL_CERT_FILE` *replaces* that store rather than adding to it, so
+  # without the assembled bundle every forge call fails `invalid peer
+  # certificate: UnknownIssuer` and agent creation dies at its first step.
   #
   # `hostUnit`: this consumer is a host service, not a container, so it reads
   # the CA from the host path and the oneshot waits on `hive-tls-ca.service`