keep the cache's key and pull token for hive-priv in a root-only directory

nix/host-modules/hive-priv-cache.nix

@@ -0,0 +1,98 @@
+# The binary-cache facts hive-priv (root) trusts, kept where only root can
+# change them.
+#
+# hive-priv downloads an agent's closure from the swarm cache when a rebuild
+# asks it to. What decides whether a download is accepted — which cache, and
+# which key must have signed it — must not come from a file the unprivileged
+# hive-c0re writes, or a compromised hive-c0re could have root accept a
+# closure from a cache of its own. So:
+#
+# - the cache's address is this host's configuration
+#   ({option}`services.hyperhive.swarm.attic.domain` and `cache`), handed to
+#   hive-priv in its unit's environment;
+# - the cache's public key and the pull token are read from the store by a root
+#   oneshot, `hive-priv-cache-facts`, under this hive's own store identity, and
+#   land in `/run/hyperhive-priv/attic/` (root, `0700`; files `0600`).
+#
+# hive-c0re keeps its own copies under `/run/hyperhive/attic/` for the probe,
+# which only reports.
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  hyperhiveCfg = config.services.hyperhive;
+  hiveController = hyperhiveCfg.deploy.hive-controller;
+  tls = hiveController.tls;
+  baoCfg = hyperhiveCfg.swarm.bao;
+  baoDeploy = hyperhiveCfg.deploy.bao;
+  atticCfg = hyperhiveCfg.swarm.attic;
+
+  # Without a cache to name, a hive name to read under or an identity to log
+  # in with there is nothing to fetch, and hive-priv has no cache to download
+  # from.
+  enabled =
+    hiveController.enable
+    && atticCfg.domain != null
+    && atticCfg.cache != null
+    && hiveController.hiveName != null
+    && tls.baoHiveIdentityCertFile != null
+    && tls.baoHiveIdentityKeyFile != null;
+
+  dir = "/run/hyperhive-priv/attic";
+
+  storeRetry = import ./lib/store-retry.nix { };
+  storeRefreshTimer = import ./lib/store-refresh-timer.nix { };
+in
+{
+  config = lib.mkIf enabled {
+    systemd.tmpfiles.rules = [ "d /run/hyperhive-priv 0700 root root - -" ];
+
+    # The URL nix is told is the only substituter for the download; no request
+    # chooses it.
+    systemd.services.hive-priv.environment.HIVE_PRIV_CACHE_URL =
+      "https://${atticCfg.domain}/${atticCfg.cache}";
+
+    systemd.services.hive-priv-cache-facts = {
+      description = "Read the swarm cache's public key and pull token for hive-priv";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [
+        "network-online.target"
+        "systemd-tmpfiles-setup.service"
+      ];
+      path = [
+        baoDeploy.package
+        pkgs.coreutils
+        pkgs.gnugrep
+        pkgs.systemd
+      ];
+      environment = {
+        BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
+        BAO_CLIENT_CERT = tls.baoHiveIdentityCertFile;
+        BAO_CLIENT_KEY = tls.baoHiveIdentityKeyFile;
+      }
+      // lib.optionalAttrs (baoDeploy.serverCaFile != null) {
+        BAO_CACERT = baoDeploy.serverCaFile;
+      };
+      # ./lib/store-retry.nix: the login fails for as long as the store is
+      # sealed or down.
+      inherit (storeRetry) startLimitBurst startLimitIntervalSec;
+      serviceConfig = storeRetry.serviceConfig // {
+        Type = "oneshot";
+        UMask = "0077";
+        SyslogIdentifier = "hive-priv-cache-facts";
+        TimeoutStartSec = "5min";
+      };
+      script = import ./lib/attic-root-facts.nix { inherit lib; } {
+        hive = hiveController.hiveName;
+        host = atticCfg.domain;
+        inherit dir;
+      };
+    };
+
+    systemd.timers.hive-priv-cache-facts = storeRefreshTimer "re-read the swarm cache's facts for hive-priv";
+  };
+}