vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-gateway: chown key.pem root:nginx 0640 for pre-start nginx -t

Browse source 
nginx-pre-start runs the config test as the nginx user; a 0600
root-owned key fails that check with BIO_new_file Permission denied
even though the master process would later load it as root.
This commit is contained in:
müde 2026-05-31 19:50:43 +02:00
commit adf89a1f25
1 changed files with 16 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

28
nix/modules/hive-gateway.nix
View file

@ -441,17 +441,13 @@ in
'' ''
set -eu set -eu
mkdir -p ${tlsDir} mkdir -p ${tlsDir}
# 0755 on BOTH the cert dir and its parent so nginx # 0755 on BOTH the cert dir and its parent so the
# (master starts as root but workers drop to the nginx # nginx user can traverse the full path. The parent
# user) can traverse the whole path to read the cert. # `/var/lib/hive-gateway` lands at 0700 by default
# The parent `/var/lib/hive-gateway` lands at 0700 by # (systemd StateDirectory / mkdir umask depending on
# default (systemd-nspawn StateDirectory / mkdir umask # which service created it first), which on its own
# depending on which service created it first), which # blocks traversal. Re-applied every boot in case a
# blocks the nginx-user worker from even reaching # prior run left a tighter mode behind.
# `${tlsDir}` and surfaces as a generic "cannot load
# certificate" at nginx start. Re-applied every boot
# in case a prior run left a tighter mode behind. Key
# stays 0600 below.
chmod 0755 ${builtins.dirOf tlsDir} chmod 0755 ${builtins.dirOf tlsDir}
chmod 0755 ${tlsDir} chmod 0755 ${tlsDir}
# Generate the cert when EITHER the cert or key is # Generate the cert when EITHER the cert or key is
@ -470,7 +466,15 @@ in
-subj "/CN=${subjectCN}" \ -subj "/CN=${subjectCN}" \
-addext "subjectAltName=${sanLines}" -addext "subjectAltName=${sanLines}"
fi fi
chmod 0600 ${tlsKey} # Key owned by root:nginx, mode 0640 so nginx-pre-start
# (which runs `nginx -t` as the nginx user, not root)
# can read it. A 0600 root:root key passes the master-
# process load (master starts as root) but fails the
# pre-start config test with `BIO_new_file() …
# Permission denied`, blocking the unit from starting
# at all. Cert is world-readable.
chown root:nginx ${tlsKey}
chmod 0640 ${tlsKey}
chmod 0644 ${tlsCert} chmod 0644 ${tlsCert}
''; '';
}; };