vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: correct two comments that still describe a runtime-generated hive CA

Browse source 
swarm-controller.nix said the gateway leaf is signed by a hive CA generated
at runtime; lib/hive-ca-trust.nix said hive-tls-ca generates the CA and that
containers bind ca.pem, while the code binds trust-bundle.pem.

Refs #4588
This commit is contained in:
atlas 2026-10-04 15:49:31 +02:00 • committed by mara
commit 5d26908c6f
2 changed files with 13 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/lib/hive-ca-trust.nix
View file

@ -1,10 +1,11 @@
# Shared hive-CA trust plumbing for containers that must trust the # Shared hive-CA trust plumbing for containers that must trust the
# self-signed gateway/forge leaf for *outbound* TLS (webhook delivery, # self-signed gateway/forge leaf for *outbound* TLS (webhook delivery,
# CI artifact upload, …). The hive CA is generated at runtime by the host # CI artifact upload, …). The anchors exist only at runtime — the host
# `hive-tls-ca.service` (see `hive-tls.nix`) — it can't be baked into a # `hive-tls-ca.service` (see `hive-tls.nix`) assembles them into
# derivation — so each such container binds the public `ca.pem` read-only # `trust-bundle.pem` — so they can't be baked into a derivation. Each such
# and orders its `container@<name>` unit after `hive-tls-ca.service` so the # container binds that bundle read-only and orders its `container@<name>`
# bind source exists before nspawn sets the mount up. # unit after `hive-tls-ca.service` so the bind source exists before nspawn
# sets the mount up.
# #
# `bindMount` + `containerOrdering` are the language-agnostic half. The # `bindMount` + `containerOrdering` are the language-agnostic half. The
# *consumption* differs per runtime: an additive variable (Node's # *consumption* differs per runtime: an additive variable (Node's

14
nix/host-modules/swarm-controller.nix
View file

@ -146,13 +146,13 @@ let
matrixCfg = config.services.hyperhive.swarm.matrix; matrixCfg = config.services.hyperhive.swarm.matrix;
# The controller's forge client speaks TLS to `https://${forgeCfg.domain}`, # The controller's forge client speaks TLS to `https://${forgeCfg.domain}`,
# which the gateway serves with a leaf signed by the hive CA — a CA # which the gateway serves with a leaf issued by the secret store's `pki`
# generated at runtime, so nothing build-time can name it and it is not in # mount, whose root is generated inside the store at runtime, so nothing
# the system store. `reqwest`/`rustls` resolves roots through # build-time can name it and it is not in the system store.
# `rustls-native-certs`, whose `SSL_CERT_FILE` *replaces* that store rather # `reqwest`/`rustls` resolves roots through `rustls-native-certs`, whose
# than adding to it, so without the assembled bundle every forge call fails # `SSL_CERT_FILE` *replaces* that store rather than adding to it, so
# `invalid peer certificate: UnknownIssuer` and agent creation dies at its # without the assembled bundle every forge call fails `invalid peer
# first step. # certificate: UnknownIssuer` and agent creation dies at its first step.
# #
# `hostUnit`: this consumer is a host service, not a container, so it reads # `hostUnit`: this consumer is a host service, not a container, so it reads
# the CA from the host path and the oneshot waits on `hive-tls-ca.service` # the CA from the host path and the oneshot waits on `hive-tls-ca.service`