vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: no hive leaf or hive identity on a gateway host without a hive

Browse source 
A self-signed gateway on a host with deploy.hive-controller.enable off
(a dedicated swarm-services host) needed the hive leaf for its catch-all,
and that leaf now comes only from hive-tls-resign with a per-hive store
identity. hive-tls-resign and its timer are now defined only where a hive
runs; elsewhere hive-gateway-self-signed-cert installs the swarm-services
leaf as the default cert, and the gateway waits for swarm-services-cert.
Also corrects the hive-gateway comments and option text that still said
the leaf is hive-CA-signed.

Refs #4588
This commit is contained in:
atlas 2026-10-04 16:56:10 +02:00 • committed by mara
commit 75a7dccee6
6 changed files with 90 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/hive-gateway/options.nix
View file

@ -159,7 +159,7 @@ in
Which issuer covers a name is **gateway** knowledge, not the
service's: a swarm service's name can sit outside this hive's
domain, and the hive CA is name-constrained out of it, so that
domain, and the hive leaf's role refuses it, so that
vhost must serve the swarm-services leaf while everything else
keeps the hive leaf. A service module calls this instead of
deciding — deciding is how the vhost and the cert stop
@ -231,7 +231,7 @@ in
defaultText = lib.literalExpression "tls.certDir == null && !tls.acme.enable";
description = ''
Read-only derived flag: `true` when the gateway serves the
self-signed (hive-CA-signed) leaf — i.e. neither `tls.certDir` nor
self-signed leaf the secret store issues — i.e. neither `tls.certDir` nor
`tls.acme.enable` is configured. Single source of truth for the
self-signed condition; consumed by the `hive-tls` and `hive-ci`
modules so the derivation isn't duplicated. Internal — not meant to
@ -261,7 +261,7 @@ in
Path to a host directory containing a TLS certificate and
private key for nginx. When set, nginx listens on `httpsPort`
and uses this cert, overriding the self-signed default — the
auto-generated hive-CA-signed leaf is skipped entirely.
store-issued self-signed leaf is skipped entirely.
nginx reads `<certDir>/<tls.certName>` and
`<certDir>/<tls.keyName>` directly — it runs on the host, so