vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep the cache's key and pull token for hive-priv in a root-only directory

Browse source
This commit is contained in:
atlas 2026-10-28 02:21:01 +01:00
commit b845630023
1 changed files with 519 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/hive-tls.nix
View file

@ -127,8 +127,9 @@ let
# The hive's own store identity: its subject is
# `<hiveLeafCommonNamePrefix>-<hiveName>`, and its policy may issue from
# `hiveLeafRole` alone. It also carries the root fetch's handshake. Every
# hive must hold one.
# `hiveLeafRole` and read this hive's own cache public key and pull token
# (`hive-priv-cache-facts`, ./hive-priv-cache.nix), and nothing else. It also
# carries the root fetch's handshake. Every hive must hold one.
haveHiveIdentity = cfg.baoHiveIdentityCertFile != null && cfg.baoHiveIdentityKeyFile != null;
requireHiveIdentity = requireIdentity {
holder = "this hive";
@ -327,7 +328,8 @@ in
Its subject has to be
`<services.hyperhive.deploy.bao.hiveLeafCommonNamePrefix>-<hiveName>`;
that cert-auth role's policy may issue from this hive's gateway-leaf
role and nothing else.
role and read this hive's own cache public key and pull token, and
nothing else. `hive-priv-cache-facts` reads those two under this identity.
Every hive with a self-signed gateway needs it: without it both units
fail, naming this option and