From 8c2f81abad6c5092e5443e05d6472703b581762c Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 30 Sep 2026 22:12:13 +0200 Subject: [PATCH] hive-tls: say the root fetch uses the reader cert for the handshake only `baoClientCertFile`'s description said the services-cert unit had no business holding `deploy.bao.clientCertFile`. Under mara's ruling that every hive has a store identity, the root fetch presents that reader cert. It is used only for the mTLS handshake of `pki/ca/pem`, which takes no token, and the unit never logs in with it. The description now says so, and the fetch is marked interim until each hive has its own narrow store identity. Refs #4588 (review c88790). --- nix/host-modules/hive-tls.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix index 5d599384..40bee15a 100644 --- a/nix/host-modules/hive-tls.nix +++ b/nix/host-modules/hive-tls.nix @@ -389,8 +389,9 @@ in A **separate** credential from {option}`services.hyperhive.deploy.bao.clientCertFile`, which is this hive's own reader identity and whose policy reads every secret the - hive is entitled to. A unit that renews one server certificate has no - business holding that. + hive is entitled to. `swarm-services-cert` never logs in with that one: + on a hive fronting no swarm name it presents it only for the mTLS + handshake of the root fetch, since `pki/ca/pem` takes no token. On a hive that mints its own store PKI a glue module supplies the leaf as a `mkDefault`; everywhere else it is the credential an operator @@ -806,6 +807,8 @@ in err="$(mktemp)" raw="$(mktemp "$d/swarm-services-root.XXXXXX")" trap 'rm -f "$err" "$raw"' EXIT + # Interim: the reader cert is the handshake identity until each hive + # has its own narrow store identity for issuing its leaf. if ! curl --fail --silent --show-error \ ${storeRootCurlTls} --output "$raw" \ "$BAO_ADDR/v1/${baoServicesPkiMount}/ca/pem" 2>"$err"; then