vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: a store-only host without a hive starts its gateway with the store sealed

Browse source 
A gateway host without a hive whose only swarm name is the store's UI no
longer waits for swarm-services-cert: its nginx carries the stream
passthrough to the store and must come up while the store is sealed. Until
the services leaf lands, hive-gateway-self-signed-cert installs a throwaway
self-signed pair on the default and swarm-services paths there; on a host
without a hive it never references the hive leaf.

A host without a hive also no longer mints the hive-leaf identity or
defaults the options pointing at it, and does not render the hive-domain
vhost, whose upstream is hive-c0re.

Refs #4588
This commit is contained in:
atlas 2026-10-04 17:24:11 +02:00 • committed by mara
commit 60268b70b0
9 changed files with 168 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/host-modules/hive-tls.nix
View file

@ -40,17 +40,15 @@ let
# host's nginx also carries the stream passthrough every reader dials to
# reach the store, and waiting on a login to that store would take that
# path down whenever it is sealed. There the gateway starts on the hive
# leaf fallback, and the issuing script re-imports the services leaf into
# the running nginx once it lands.
# leaf, or on a host without a hive on a throwaway self-signed pair
# (../hive-gateway/default.nix), and the issuing script re-imports the
# services leaf into the running nginx once it lands.
#
# Nor on a host fronting no swarm name: it asks the store for the root
# alone, which nginx never reads, and a sealed store would otherwise hold
# its gateway down.
#
# On a host with no hive there is no hive leaf to start on: the services
# leaf is the only certificate its gateway has, so it always waits.
gatewayWaitsForServicesLeaf =
localServiceDomains != [ ] && (!runsHive || localServiceDomains != [ baoCfg.ui.domain ]);
localServiceDomains != [ ] && localServiceDomains != [ baoCfg.ui.domain ];
# The hive leaf, `hive-tls-resign` and the hive identity it needs exist only
# where a hive runs. A gateway host without one serves the swarm-services