vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

trust the swarm services ca in swarm-ci-metrics

Browse source 
The poller's forge, authelia and collector calls go to leaves issued by
the swarm's own CA, and its reqwest/rustls roots come from SSL_CERT_FILE,
which the unit never set. Every pass since it was deployed fails
"invalid peer certificate: UnknownIssuer" before pushing, so the CI runs
dashboard has no hyperhive.ci.run.* samples (#5438).

- nix/host-modules/swarm-ci-metrics.nix: import lib/hive-ca-trust.nix and
  register a host trustBundle for the unit, as swarm-controller does; it
  adds swarm-ci-metrics-ca-bundle.service and sets SSL_CERT_FILE.
- nix/module-eval/ci-metrics.nix: a case asserting the unit's
  SSL_CERT_FILE is its bundle path when self-signed, with the bundle
  unit's ordering, and absent where the poller is off.
- docs/swarm/ci-metrics.md: how the poller trusts the swarm's CA.
This commit is contained in:
atlas 2026-10-17 22:51:16 +02:00 • committed by mara
commit 6630a51022
3 changed files with 51 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nix/module-eval/ci-metrics.nix
View file

@ -1,8 +1,8 @@
# `checks.module-eval-ci-metrics` — see ./lib.nix for the shared rationale
# (why this suite exists, naming convention, "evaluates not executes"). The CI
# run poller's unit and timer, its default, its collector route and its IdP
# registration; its store grants are in ./bao-grants.nix beside every other
# principal's, and its dashboard in ./grafana.nix.
# run poller's unit and timer, its default, its CA trust, its collector route
# and its IdP registration; its store grants are in ./bao-grants.nix beside
# every other principal's, and its dashboard in ./grafana.nix.
#
# Every fixture is a shared one, so this cluster evaluates no host of its own.
{
@ -78,6 +78,22 @@ let
&& lib.elem "otlp/swarm-ci-metrics" s.service.pipelines."metrics/${otel.producerName}".receivers
&& h.services.nginx.virtualHosts.${otel.domain}.locations ? "/swarm-ci-metrics/";
}
{
# The forge, authelia and the collector chain to the swarm's own CA;
# without the bundle every pass fails `UnknownIssuer`. hive-c0re's
# bundle on the bare host is the control that the absence arm looks up
# a unit name the module would write.
name = "the poller trusts the swarm's CA through its own bundle, which exists only where the poller does";
ok =
allLocal.services.hyperhive.gateway.useSelfSigned
&& (env.SSL_CERT_FILE or null) == "/run/swarm-ci-metrics-ca/trust-bundle.pem"
&& lib.elem "swarm-ci-metrics-ca-bundle.service" svc.requires
&& lib.elem "hive-tls-ca.service" (
allLocal.systemd.services.swarm-ci-metrics-ca-bundle.requires or [ ]
)
&& bare.systemd.services ? hive-c0re-ca-bundle
&& !(bare.systemd.services ? swarm-ci-metrics-ca-bundle);
}
{
name = "the poller's client is registered as a machine, and the publisher carries its secret";
ok =