vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: no hive leaf or hive identity on a gateway host without a hive

Browse source 
A self-signed gateway on a host with deploy.hive-controller.enable off
(a dedicated swarm-services host) needed the hive leaf for its catch-all,
and that leaf now comes only from hive-tls-resign with a per-hive store
identity. hive-tls-resign and its timer are now defined only where a hive
runs; elsewhere hive-gateway-self-signed-cert installs the swarm-services
leaf as the default cert, and the gateway waits for swarm-services-cert.
Also corrects the hive-gateway comments and option text that still said
the leaf is hive-CA-signed.

Refs #4588
This commit is contained in:
atlas 2026-10-04 16:56:10 +02:00 • committed by mara
commit 75a7dccee6
6 changed files with 90 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

38
nix/module-eval/swarm-services-switch.nix
View file

@ -30,6 +30,14 @@ let
deploy.allSwarmServices = true;
};
# A services host with hives elsewhere and the store elsewhere too: no hive
# and no store identity minted here.
swarmServicesOnlyNoStore = hive {
deploy.hive-controller.enable = false;
deploy.allSwarmServices = true;
deploy.bao.enable = false;
};
# The same switch with every service it owns placed elsewhere, so the only
# thing that can enable the gateway/resolver/bridge here is that toggle's
# own module — each service module asserts them from its own `enable`.
@ -187,6 +195,36 @@ let
&& swarmServicesSwitchAlone.services.hyperhive.gateway.dns.enable
&& swarmServicesSwitchAlone.services.hyperhive.network.enable;
}
{
# No hive, so no hive leaf and no hive identity: the gateway's default
# certificate is the swarm-services leaf, and its start waits for that
# leaf. The control is a hive host with the same services, which keeps
# the hive leaf and the unit that issues it.
name = "a gateway host without a hive serves the swarm-services leaf as its default cert and has no hive-leaf unit";
ok =
let
noHive =
m:
let
s = m.systemd.services;
imp = s.hive-gateway-self-signed-cert.script;
in
!(s ? hive-tls-resign)
&& !(m.systemd.timers ? hive-tls-resign)
&& lib.hasInfix "install -m 0644 /var/lib/hive-tls/swarm-services.pem /var/lib/hive-gateway/tls/cert.pem" imp
&& !(lib.hasInfix "/var/lib/hive-tls/gateway.pem /var/lib/hive-gateway/tls/cert.pem" imp)
&& lib.elem "hive-gateway-self-signed-cert.service" s.swarm-services-cert.requiredBy
&& lib.elem "hive-gateway-self-signed-cert.service" s.swarm-services-cert.before
# Fronting swarm names, so the root-only branch that presents the
# hive identity is not the one that runs.
&& lib.hasInfix "want_svc=1" s.swarm-services-cert.script;
hs = swarmServicesHere.systemd.services;
in
noHive swarmServicesOnly
&& noHive swarmServicesOnlyNoStore
&& hs ? hive-tls-resign
&& lib.hasInfix "install -m 0644 /var/lib/hive-tls/gateway.pem /var/lib/hive-gateway/tls/cert.pem" hs.hive-gateway-self-signed-cert.script;
}
{
# Each service is gated on its own deployment toggle alone, so a host
# that runs no hive still runs every shared service the switch turns