vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep the cache's key and pull token for hive-priv in a root-only directory

Browse source
This commit is contained in:
atlas 2026-10-28 02:21:01 +01:00
commit b845630023
1 changed files with 519 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

48
nix/module-eval/hive-tls.nix
View file

@ -758,6 +758,54 @@ let
]
&& lib.hasInfix "--connect-timeout 10 --max-time 30" (noSvcBranch noSvcFetch);
}
{
# What hive-priv trusts comes from root-owned places: the store, under
# this hive's own identity, and nothing under `swarm/services/`, which
# no hive may read.
name = "the root cache-facts unit reads this hive's own facts under its store identity and writes a root-only directory";
ok =
let
u = units.hive-priv-cache-facts;
in
lib.hasInfix "secret/swarm/hives/h1/attic" u.script
&& !(lib.hasInfix "swarm/services" u.script)
&& !(lib.hasInfix "swarm/hives/h2" u.script)
&& lib.hasInfix "dir=/run/hyperhive-priv/attic" u.script
&& lib.hasInfix "install -d -m 0700 \"$dir\"" u.script
&& lib.hasInfix ''atomic_write_secret 0600 "" "$dir/public-key"'' u.script
&& lib.hasInfix ''atomic_write_secret 0600 "" "$dir/netrc"'' u.script
&& lib.hasInfix "machine attic.t.local password" u.script
&& u.environment.BAO_CLIENT_CERT == leafUnit.environment.BAO_CLIENT_CERT
&& u.environment.BAO_CLIENT_KEY == leafUnit.environment.BAO_CLIENT_KEY
&& u.environment.BAO_CLIENT_CERT != allLocal.services.hyperhive.deploy.bao.clientCertFile
&& u.serviceConfig.Type == "oneshot"
&& !(remainsAfterExit u)
&& lib.elem "d /run/hyperhive-priv 0700 root root - -" allLocal.systemd.tmpfiles.rules;
}
{
# The control for the case above, and the one below: a hive with no
# store identity has neither unit and hive-priv gets no cache URL, so a
# lookup that always came back empty would fail the case before it.
name = "the cache-facts unit has a timer, and a hive with no store identity has neither unit";
ok =
let
t = allLocal.systemd.timers.hive-priv-cache-facts;
in
lib.elem "timers.target" t.wantedBy
&& t.timerConfig.OnUnitInactiveSec == "10min"
&& !(noIdentity.systemd.services ? hive-priv-cache-facts)
&& !(noIdentity.systemd.timers ? hive-priv-cache-facts)
&& noService.systemd.services ? hive-priv-cache-facts
&&
noService.systemd.services.hive-priv-cache-facts.environment.BAO_CLIENT_CERT
== "/etc/pki/bao-hive.pem";
}
{
name = "hive-priv is told the cache's address by the host's configuration";
ok =
allLocal.systemd.services.hive-priv.environment.HIVE_PRIV_CACHE_URL == "https://attic.t.local/swarm"
&& !(noIdentity.systemd.services.hive-priv.environment ? HIVE_PRIV_CACHE_URL);
}
];
in
runGroup "hive-tls" cases