vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: replace deprecated no-op options with mkRemovedOptionModule

Browse source
This commit is contained in:
müde 2026-07-13 21:58:30 +02:00
commit 7ad2bb9211
8 changed files with 85 additions and 189 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nix/modules/hive-tls.nix
View file

@ -22,19 +22,17 @@ in
{
# Host-side TLS trust root for the self-signed gateway mode.
#
# `gateway.selfSignedTls` historically generated a *bare* self-signed
# leaf inside the gateway container at first boot. A bare leaf is its
# own trust anchor, so every regeneration is a new anchor and every
# consumer (agents, federation peers) would have to re-trust on each
# rotation — and a runtime-generated, in-container cert can't be wired
# into an agent's build-time trust store at all.
# A bare self-signed leaf would be its own trust anchor, so every
# regeneration would be a new anchor and every consumer (agents,
# federation peers) would have to re-trust on each rotation — and a
# runtime-generated, in-container cert can't be wired into an agent's
# build-time trust store at all.
#
# This module moves the anchor to a long-lived **hive CA** held on the
# host. The gateway serves a **leaf** signed by that CA (via the
# existing `tls.certDir` bind-mount path); agents and federation peers
# trust the *CA* once, and leaf rotation never re-breaks them. See
# `docs/gateway.md` ("Self-signed TLS") and issue-tracker discussion of
# agent web-UI reachability.
# So the anchor is a long-lived **hive CA** held on the host. The
# gateway serves a **leaf** signed by that CA (via the `tls.certDir`
# bind-mount path); agents and federation peers trust the *CA* once,
# and leaf rotation never re-breaks them. See `docs/gateway.md`
# ("Self-signed TLS").
options.services.hyperhive.tls = {
stateDir = lib.mkOption {