vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: correct two comments that still describe a runtime-generated hive CA

Browse source 
swarm-controller.nix said the gateway leaf is signed by a hive CA generated
at runtime; lib/hive-ca-trust.nix said hive-tls-ca generates the CA and that
containers bind ca.pem, while the code binds trust-bundle.pem.

Refs #4588
This commit is contained in:
atlas 2026-10-04 15:49:31 +02:00 • committed by mara
commit 5d26908c6f
2 changed files with 13 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/lib/hive-ca-trust.nix
View file

@ -1,10 +1,11 @@
# Shared hive-CA trust plumbing for containers that must trust the
# self-signed gateway/forge leaf for *outbound* TLS (webhook delivery,
# CI artifact upload, …). The hive CA is generated at runtime by the host
# `hive-tls-ca.service` (see `hive-tls.nix`) — it can't be baked into a
# derivation — so each such container binds the public `ca.pem` read-only
# and orders its `container@<name>` unit after `hive-tls-ca.service` so the
# bind source exists before nspawn sets the mount up.
# CI artifact upload, …). The anchors exist only at runtime — the host
# `hive-tls-ca.service` (see `hive-tls.nix`) assembles them into
# `trust-bundle.pem` — so they can't be baked into a derivation. Each such
# container binds that bundle read-only and orders its `container@<name>`
# unit after `hive-tls-ca.service` so the bind source exists before nspawn
# sets the mount up.
#
# `bindMount` + `containerOrdering` are the language-agnostic half. The
# *consumption* differs per runtime: an additive variable (Node's