vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

refactor(#2427): extract shared hive-CA trust bind-mount helper

Browse source 
hive-ci and hive-forge both bind the runtime-generated hive CA cert
read-only and order their container@ unit after hive-tls-ca.service so
the bind source exists before nspawn sets the mount up — the same
bind-mount + ordering + rationale duplicated verbatim in two modules.

Extract that language-agnostic half into a pure helper,
nix/host-modules/lib/hive-ca-trust.nix, taking a container name and
returning { useSelfSigned, caContainerPath, bindMount, containerOrdering }.
The per-runtime consumption stays at each call site (hive-ci's additive
NODE_EXTRA_CA_CERTS, hive-forge's Go SSL_CERT_FILE concat). hive-ci folds
containerOrdering into its existing mkMerge alongside the TimeoutStartSec
bump.

The helper is a pure function, not a module: host-modules/default.nix is
an explicit aggregator (not a glob) and the docs eval imports that same
aggregator, so the lib/ file is never picked up as a module. A third
outbound-TLS-trusting container no longer means a third copy-paste.
This commit is contained in:
atlas 2026-07-15 20:06:43 +02:00 • committed by mara
commit 6c4ef5f798
3 changed files with 92 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

40
nix/host-modules/hive-ci.nix
View file

@ -17,11 +17,12 @@ let
# `upload-artifact`, which POSTs to the ROOT_URL-derived artifact endpoint)
# reject the chain, since Node trusts only its bundled CA bundle, not the
# system store. Trust the hive CA explicitly via NODE_EXTRA_CA_CERTS below.
# `gateway.useSelfSigned` is the gateway module's single source of truth
# for the self-signed condition (no duplicated derivation here).
useSelfSigned = gatewayCfg.useSelfSigned;
caHostPath = "${tlsCfg.stateDir}/ca.pem";
caContainerPath = "/run/hive-ca/ca.pem";
# The bind-mount + `container@` ordering that makes the CA reachable are
# shared with hive-forge via the `hive-ca-trust` helper; only the Node
# `NODE_EXTRA_CA_CERTS` consumption is hive-ci-specific.
caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
useSelfSigned = caTrust.useSelfSigned;
caContainerPath = caTrust.caContainerPath;
# hive-c0re writes its own admin token here on first forge startup.
# The token has read:admin + write:admin scopes — sufficient to call
@ -347,15 +348,11 @@ in
};
};
# Self-signed mode: the CA cert the bind-mount above sources is
# generated by the host `hive-tls-ca` service. Order the container after
# it so the bind source exists before nspawn sets the mount up (a
# condition-skipped/late CA would otherwise fail the container start).
# `caTrust.containerOrdering` orders this unit after `hive-tls-ca.service`
# in self-signed mode (see the hive-ca-trust helper); merged with the
# hive-ci-specific start-timeout bump below.
systemd.services."container@hive-ci" = lib.mkMerge [
(lib.mkIf useSelfSigned {
after = [ "hive-tls-ca.service" ];
requires = [ "hive-tls-ca.service" ];
})
caTrust.containerOrdering
{
# gitea-runner registration (hive-ci-prefetch, host-side)
# sits on the boot-critical path — the container's nspawn readiness
@ -394,18 +391,11 @@ in
isReadOnly = true;
};
}
# Self-signed mode: bind ONLY the public hive CA cert (never the
# `hive-tls` state dir — it holds the CA + leaf private keys) so the
# runner's Node actions can trust the gateway/forge self-signed leaf
# (see NODE_EXTRA_CA_CERTS in the container config). Source generated
# by the host `hive-tls-ca` service; the container@hive-ci ordering
# below guarantees it exists before this mount is set up.
// lib.optionalAttrs useSelfSigned {
${caContainerPath} = {
hostPath = caHostPath;
isReadOnly = true;
};
};
# Self-signed mode: bind the public hive CA cert read-only so the
# runner's Node actions trust the gateway/forge leaf (consumed via
# NODE_EXTRA_CA_CERTS in the container config). Shared bind-mount +
# ordering come from the hive-ca-trust helper.
// caTrust.bindMount;
config =
{ pkgs, lib, ... }: