vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-gateway: chown key.pem root:nginx 0640 for pre-start nginx -t

Browse source 
nginx-pre-start runs the config test as the nginx user; a 0600
root-owned key fails that check with BIO_new_file Permission denied
even though the master process would later load it as root.
This commit is contained in:
müde 2026-05-31 19:50:43 +02:00
commit adf89a1f25
1 changed files with 16 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

28
nix/modules/hive-gateway.nix
View file

@ -441,17 +441,13 @@ in
''
set -eu
mkdir -p ${tlsDir}
# 0755 on BOTH the cert dir and its parent so nginx
# (master starts as root but workers drop to the nginx
# user) can traverse the whole path to read the cert.
# The parent `/var/lib/hive-gateway` lands at 0700 by
# default (systemd-nspawn StateDirectory / mkdir umask
# depending on which service created it first), which
# blocks the nginx-user worker from even reaching
# `${tlsDir}` and surfaces as a generic "cannot load
# certificate" at nginx start. Re-applied every boot
# in case a prior run left a tighter mode behind. Key
# stays 0600 below.
# 0755 on BOTH the cert dir and its parent so the
# nginx user can traverse the full path. The parent
# `/var/lib/hive-gateway` lands at 0700 by default
# (systemd StateDirectory / mkdir umask depending on
# which service created it first), which on its own
# blocks traversal. Re-applied every boot in case a
# prior run left a tighter mode behind.
chmod 0755 ${builtins.dirOf tlsDir}
chmod 0755 ${tlsDir}
# Generate the cert when EITHER the cert or key is
@ -470,7 +466,15 @@ in
-subj "/CN=${subjectCN}" \
-addext "subjectAltName=${sanLines}"
fi
chmod 0600 ${tlsKey}
# Key owned by root:nginx, mode 0640 so nginx-pre-start
# (which runs `nginx -t` as the nginx user, not root)
# can read it. A 0600 root:root key passes the master-
# process load (master starts as root) but fails the
# pre-start config test with `BIO_new_file() …
# Permission denied`, blocking the unit from starting
# at all. Cert is world-readable.
chown root:nginx ${tlsKey}
chmod 0640 ${tlsKey}
chmod 0644 ${tlsCert}
'';
};