vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: correct two comments that still describe a runtime-generated hive CA

Browse source 
swarm-controller.nix said the gateway leaf is signed by a hive CA generated
at runtime; lib/hive-ca-trust.nix said hive-tls-ca generates the CA and that
containers bind ca.pem, while the code binds trust-bundle.pem.

Refs #4588
This commit is contained in:
atlas 2026-10-04 15:49:31 +02:00 • committed by mara
commit 5d26908c6f
2 changed files with 13 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/host-modules/swarm-controller.nix
View file

@ -146,13 +146,13 @@ let
matrixCfg = config.services.hyperhive.swarm.matrix;
# The controller's forge client speaks TLS to `https://${forgeCfg.domain}`,
# which the gateway serves with a leaf signed by the hive CA — a CA
# generated at runtime, so nothing build-time can name it and it is not in
# the system store. `reqwest`/`rustls` resolves roots through
# `rustls-native-certs`, whose `SSL_CERT_FILE` *replaces* that store rather
# than adding to it, so without the assembled bundle every forge call fails
# `invalid peer certificate: UnknownIssuer` and agent creation dies at its
# first step.
# which the gateway serves with a leaf issued by the secret store's `pki`
# mount, whose root is generated inside the store at runtime, so nothing
# build-time can name it and it is not in the system store.
# `reqwest`/`rustls` resolves roots through `rustls-native-certs`, whose
# `SSL_CERT_FILE` *replaces* that store rather than adding to it, so
# without the assembled bundle every forge call fails `invalid peer
# certificate: UnknownIssuer` and agent creation dies at its first step.
#
# `hostUnit`: this consumer is a host service, not a container, so it reads
# the CA from the host path and the oneshot waits on `hive-tls-ca.service`