vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(hive-forge): give the SSO-source unit the same TLS trust as forgejo

Browse source 
Registering the OIDC login source makes an outbound HTTPS call - the CLI
fetches <issuer>/.well-known/openid-configuration to validate the
provider before writing the row. That URL is a swarm service name served
under the swarm CA, which the default system store has never heard of.

SSL_CERT_FILE was set on forgejo.service and not on
forgejo-sso-source.service, so the web service trusted the chain and the
registration one-shot did not. Same binary, same host, different unit.
The result was a 100% reproducible failure that no restart could fix:
nothing about restarting a unit gives it an environment variable it
never had. Every recorded run since the feature landed has failed with
x509: certificate signed by unknown authority.

The trust belongs to every process that makes the call, not to the
service that happens to be the obvious consumer.
This commit is contained in:
atlas 2026-08-15 21:58:40 +02:00 • committed by mara
commit bc594a36ef
1 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/host-modules/hive-forge/default.nix
View file

@ -849,7 +849,24 @@ in
};
# `FORGEJO_CUSTOM` (not `GITEA_CUSTOM` — forgejo renamed it)
# is how the CLI finds the app.ini upstream's module wrote.
environment.FORGEJO_CUSTOM = "/var/lib/forgejo/custom";
#
# `SSL_CERT_FILE` for the same reason `forgejo.service` has it,
# and it was missing here: registering the login source makes an
# **outbound HTTPS call** — the CLI fetches
# `<issuer>/.well-known/openid-configuration` to validate the
# provider before writing the row. That URL is a swarm service
# name served under the swarm CA, which the default system store
# has never heard of, so without this the unit fails every single
# time with `x509: certificate signed by unknown authority` and no
# restart can help it.
#
# The trust belongs to every process that makes the call, not to
# the service that happens to be the obvious consumer. Same
# binary, same host, different unit — and only one of them had it.
environment = {
FORGEJO_CUSTOM = "/var/lib/forgejo/custom";
}
// lib.optionalAttrs useSelfSigned { SSL_CERT_FILE = forgeCaBundle; };
path = [
cfg.package
pkgs.coreutils