From 80dd4babd425d2ad066f23538ac0d134a9be7931 Mon Sep 17 00:00:00 2001 From: damocles Date: Sun, 31 May 2026 17:54:44 +0200 Subject: [PATCH] =?UTF-8?q?hive-gateway:=20also=20gate=20cert=20gen=20on?= =?UTF-8?q?=20key=20existence=20(argus=20=F0=9F=9F=A1=20on=20#865)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- nix/modules/hive-gateway.nix | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index 07cbd697..da924288 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -446,11 +446,15 @@ in # path. Re-applied every boot in case a prior run left # a tighter mode behind. Key stays 0600 below. chmod 0755 ${tlsDir} - # Generate the cert when it's missing OR fails an - # openssl parse — catches truncated / corrupt leftovers - # from a previous interrupted run. The whole oneshot is - # safe to re-run; a healthy cert is left alone. - if [ ! -s ${tlsCert} ] || ! openssl x509 -in ${tlsCert} -noout >/dev/null 2>&1; then + # Generate the cert when EITHER the cert or key is + # missing/empty, OR the cert fails an openssl parse — + # catches truncated / corrupt leftovers from a previous + # interrupted run AND the "cert clean but key absent" + # edge case (argus 🟡 on the first revision) which + # otherwise tripped `chmod 0600 ${tlsKey}` below with + # ENOENT under `set -eu`. The whole oneshot is safe to + # re-run; a healthy cert+key pair is left alone. + if [ ! -s ${tlsCert} ] || [ ! -s ${tlsKey} ] || ! openssl x509 -in ${tlsCert} -noout >/dev/null 2>&1; then echo "generating fresh self-signed cert at ${tlsCert}" openssl req -x509 -newkey rsa:4096 -nodes -sha256 -days 3650 \ -keyout ${tlsKey} \