vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarmctl: on a controller host, trust the swarm's root without SWARMCTL_CA_FILE

Browse source 
`swarmctl login` (and any `--swarm` verb) on a controller host failed TLS
with `UnknownIssuer` against the swarm's own gateway: its leaf chains to
the store's `pki` root, which no system store holds, and the only way
through was `--ca-file`/`SWARMCTL_CA_FILE` by hand.

The host's swarmctl wrapper now sets `SSL_CERT_FILE` to the bundle the
swarm-controller daemon already trusts (`/run/swarm-controller-ca/
trust-bundle.pem`: system CAs plus the swarm's root), when the gateway is
self-signed. swarmctl's reqwest/rustls resolves roots the same way the
daemon's does, so this is the path the daemon uses to reach the same
gateway. `--set` rather than a default, since a nix shell exports its own
`SSL_CERT_FILE`.

Pointing `SWARMCTL_CA_FILE` at the bundle instead would not work (#5243):
`--ca-file` adds each certificate as a root and fails the whole client on
one it can't parse.

Hosts without the controller (an operator laptop) still need `--ca-file`.

Refs #5239
Fixes #5243
This commit is contained in:
atlas 2026-10-14 10:18:40 +02:00 • committed by mara
commit 7d24feaf25
3 changed files with 20 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/module-eval/bao-controller.nix
View file

@ -146,6 +146,12 @@ let
&& lib.hasInfix "--set-default SWARMCTL_LOGIN_DEFAULT_SWARM https://t.local" swarmctlWrapperCmd
&& !(lib.hasInfix "SWARMCTL_SWARM" swarmctlWrapperCmd);
}
{
# The gateway's leaf chains to the store's root, which no system store
# holds; without the bundle `login` fails `UnknownIssuer`.
name = "the host's swarmctl trusts the swarm's root through the daemon's bundle";
ok = lib.hasInfix "--set SSL_CERT_FILE /run/swarm-controller-ca/trust-bundle.pem" swarmctlWrapperCmd;
}
{
name = "a swarm with no matrix gateway vhost gives the controller no homeserver variable";
ok =