hive-tls: a store-only host without a hive starts its gateway with the store sealed
A gateway host without a hive whose only swarm name is the store's UI no longer waits for swarm-services-cert: its nginx carries the stream passthrough to the store and must come up while the store is sealed. Until the services leaf lands, hive-gateway-self-signed-cert installs a throwaway self-signed pair on the default and swarm-services paths there; on a host without a hive it never references the hive leaf. A host without a hive also no longer mints the hive-leaf identity or defaults the options pointing at it, and does not render the hive-domain vhost, whose upstream is hive-c0re. Refs #4588
This commit is contained in:
atlas
mara
parent
75a7dccee6
commit
60268b70b0
9 changed files with 168 additions and 82 deletions
|
|
@ -38,6 +38,13 @@ let
|
|||
deploy.bao.enable = false;
|
||||
};
|
||||
|
||||
# A dedicated secret-store host: no hive, and the store's browser UI the
|
||||
# only swarm name its gateway fronts.
|
||||
storeOnlyNoHive = hive {
|
||||
deploy.hive-controller.enable = false;
|
||||
deploy.bao.enable = true;
|
||||
};
|
||||
|
||||
# The same switch with every service it owns placed elsewhere, so the only
|
||||
# thing that can enable the gateway/resolver/bridge here is that toggle's
|
||||
# own module — each service module asserts them from its own `enable`.
|
||||
|
|
@ -196,34 +203,88 @@ let
|
|||
&& swarmServicesSwitchAlone.services.hyperhive.network.enable;
|
||||
}
|
||||
{
|
||||
# No hive, so no hive leaf and no hive identity: the gateway's default
|
||||
# certificate is the swarm-services leaf, and its start waits for that
|
||||
# leaf. The control is a hive host with the same services, which keeps
|
||||
# the hive leaf and the unit that issues it.
|
||||
# No hive, so no hive leaf, no hive identity and no hive-domain vhost:
|
||||
# the default certificate is the swarm-services leaf, or a throwaway
|
||||
# pair until it lands. A host fronting many swarm names waits for that
|
||||
# leaf; a store-only host does not. The control is a hive host with
|
||||
# the same services.
|
||||
name = "a gateway host without a hive serves the swarm-services leaf as its default cert and has no hive-leaf unit";
|
||||
ok =
|
||||
let
|
||||
# Every hive-leaf reference a unit could carry: the leaf files,
|
||||
# the identity's file and subject. The store's own per-hive role
|
||||
# unit is left out: it writes roles for the hives in the swarm
|
||||
# directory, which live elsewhere.
|
||||
hiveLeafRefs = [
|
||||
"gateway.pem"
|
||||
"gateway-key.pem"
|
||||
"hive-leaf"
|
||||
"swarm-bao-hive-leaf-"
|
||||
];
|
||||
noHiveLeafAnywhere =
|
||||
m:
|
||||
let
|
||||
units = removeAttrs m.systemd.services [ "swarm-bao-hive-leaf-policy" ];
|
||||
texts = lib.concatMap (u: [
|
||||
(u.script or "")
|
||||
(builtins.toJSON (u.environment or { }))
|
||||
]) (lib.attrValues units);
|
||||
in
|
||||
!(lib.any (t: lib.any (r: lib.hasInfix r t) hiveLeafRefs) texts)
|
||||
&& m.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile == null
|
||||
&& !(m.services.nginx.virtualHosts ? "h1.t.local");
|
||||
noHive =
|
||||
m:
|
||||
let
|
||||
s = m.systemd.services;
|
||||
imp = s.hive-gateway-self-signed-cert.script;
|
||||
in
|
||||
!(s ? hive-tls-resign)
|
||||
&& !(m.systemd.timers ? hive-tls-resign)
|
||||
&& lib.hasInfix "install -m 0644 /var/lib/hive-tls/swarm-services.pem /var/lib/hive-gateway/tls/cert.pem" imp
|
||||
&& !(lib.hasInfix "/var/lib/hive-tls/gateway.pem /var/lib/hive-gateway/tls/cert.pem" imp)
|
||||
&& lib.elem "hive-gateway-self-signed-cert.service" s.swarm-services-cert.requiredBy
|
||||
&& lib.elem "hive-gateway-self-signed-cert.service" s.swarm-services-cert.before
|
||||
# Fronting swarm names, so the root-only branch that presents the
|
||||
# hive identity is not the one that runs.
|
||||
&& lib.hasInfix "want_svc=1" s.swarm-services-cert.script;
|
||||
!(s ? hive-tls-resign) && !(m.systemd.timers ? hive-tls-resign) && noHiveLeafAnywhere m;
|
||||
waitsForLeaf =
|
||||
m:
|
||||
let
|
||||
s = m.systemd.services;
|
||||
in
|
||||
lib.elem "hive-gateway-self-signed-cert.service" s.swarm-services-cert.requiredBy
|
||||
&& lib.elem "hive-gateway-self-signed-cert.service" s.swarm-services-cert.before;
|
||||
# The cert it installs on the default and swarm-services paths:
|
||||
# the services leaf when present, a throwaway pair otherwise.
|
||||
importsServicesLeafOrFallback =
|
||||
m:
|
||||
let
|
||||
imp = m.systemd.services.hive-gateway-self-signed-cert;
|
||||
in
|
||||
lib.hasInfix "cert=/var/lib/hive-tls/swarm-services.pem" imp.script
|
||||
&& lib.hasInfix "openssl req -x509" imp.script
|
||||
&& lib.hasInfix "cert=/var/lib/hive-gateway/tls/fallback.pem" imp.script
|
||||
&& lib.hasInfix ''install -m 0644 "$cert" /var/lib/hive-gateway/tls/cert.pem'' imp.script
|
||||
&& lib.hasInfix ''install -m 0644 "$cert" /var/lib/hive-gateway/tls/swarm-services.pem'' imp.script
|
||||
&& lib.any (p: lib.hasPrefix "openssl" (p.pname or (p.name or ""))) imp.path;
|
||||
store = storeOnlyNoHive;
|
||||
hs = swarmServicesHere.systemd.services;
|
||||
in
|
||||
noHive swarmServicesOnly
|
||||
&& noHive swarmServicesOnlyNoStore
|
||||
&& noHive store
|
||||
&& importsServicesLeafOrFallback swarmServicesOnly
|
||||
&& importsServicesLeafOrFallback swarmServicesOnlyNoStore
|
||||
&& importsServicesLeafOrFallback store
|
||||
# Fronting many swarm names: the gateway waits for their leaf.
|
||||
&& waitsForLeaf swarmServicesOnly
|
||||
&& waitsForLeaf swarmServicesOnlyNoStore
|
||||
# The store's UI alone: its nginx carries the passthrough to the
|
||||
# store, so it starts on the fallback with the store sealed.
|
||||
&&
|
||||
store.services.hyperhive.swarm.localServiceDomains
|
||||
== [ store.services.hyperhive.swarm.bao.ui.domain ]
|
||||
&& !(waitsForLeaf store)
|
||||
&& lib.hasInfix "want_svc=1" store.systemd.services.swarm-services-cert.script
|
||||
# Control: a hive host with the same services keeps the hive leaf,
|
||||
# its unit and identity, and the hive-domain vhost.
|
||||
&& hs ? hive-tls-resign
|
||||
&& lib.hasInfix "install -m 0644 /var/lib/hive-tls/gateway.pem /var/lib/hive-gateway/tls/cert.pem" hs.hive-gateway-self-signed-cert.script;
|
||||
&& lib.hasInfix "install -m 0644 /var/lib/hive-tls/gateway.pem /var/lib/hive-gateway/tls/cert.pem" hs.hive-gateway-self-signed-cert.script
|
||||
&& swarmServicesHere.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile != null
|
||||
&& swarmServicesHere.services.nginx.virtualHosts ? "h1.t.local"
|
||||
&& !(noHiveLeafAnywhere swarmServicesHere);
|
||||
}
|
||||
{
|
||||
# Each service is gated on its own deployment toggle alone, so a host
|
||||
|
|
|
|||
Loading…
Reference in a new issue