vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-gateway: also gate cert gen on key existence (argus 🟡 on #865)

Browse source
This commit is contained in:
damocles 2026-05-31 17:54:44 +02:00 • committed by mara
commit 80dd4babd4
1 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/modules/hive-gateway.nix
View file

@ -446,11 +446,15 @@ in
# path. Re-applied every boot in case a prior run left # path. Re-applied every boot in case a prior run left
# a tighter mode behind. Key stays 0600 below. # a tighter mode behind. Key stays 0600 below.
chmod 0755 ${tlsDir} chmod 0755 ${tlsDir}
# Generate the cert when it's missing OR fails an # Generate the cert when EITHER the cert or key is
# openssl parse — catches truncated / corrupt leftovers # missing/empty, OR the cert fails an openssl parse —
# from a previous interrupted run. The whole oneshot is # catches truncated / corrupt leftovers from a previous
# safe to re-run; a healthy cert is left alone. # interrupted run AND the "cert clean but key absent"
if [ ! -s ${tlsCert} ] || ! openssl x509 -in ${tlsCert} -noout >/dev/null 2>&1; then # edge case (argus 🟡 on the first revision) which
# otherwise tripped `chmod 0600 ${tlsKey}` below with
# ENOENT under `set -eu`. The whole oneshot is safe to
# re-run; a healthy cert+key pair is left alone.
if [ ! -s ${tlsCert} ] || [ ! -s ${tlsKey} ] || ! openssl x509 -in ${tlsCert} -noout >/dev/null 2>&1; then
echo "generating fresh self-signed cert at ${tlsCert}" echo "generating fresh self-signed cert at ${tlsCert}"
openssl req -x509 -newkey rsa:4096 -nodes -sha256 -days 3650 \ openssl req -x509 -newkey rsa:4096 -nodes -sha256 -days 3650 \
-keyout ${tlsKey} \ -keyout ${tlsKey} \