vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats: test that the server's rendered config carries the callout xkey

Browse source 
`checks.script-test-nats-render-config` runs the queue server's
`ExecStartPre` render against a scratch runtime directory: a fetched key
lands in `auth_callout.xkey` and the wrapper includes the fragment, and
a missing or malformed key file fails the start and writes no config.

module-eval only sees the render as a store path, so dropping `xkey`
from the template, or its substitution, passed every check while the
server would have run unsealed.
This commit is contained in:
atlas 2026-10-05 22:13:59 +02:00 • committed by mara
commit 6c4a459773
3 changed files with 116 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/checks.nix
View file

@ -39,6 +39,12 @@ in
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
};
# Executes the queue server's config render, which `module-eval-nats-authelia`
# only sees as a store path: the callout xkey it writes is a build output.
script-test-nats-render-config = import ./script-tests/nats-render-config.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
};
module-eval-nats-tls = import ./module-eval/nats-tls.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;