From c22db5eb579b9135b6eec33a545b3583763f4b7e Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 9 Sep 2026 18:23:58 +0200 Subject: [PATCH] swarm-bao-tls: drop the unreachable CN fallback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `clientCn` fell back to `cfg.domain` when `hiveName` was unset. That branch cannot run: `hive-network.nix` asserts `hiveName != null` under `mkIf services.hyperhive.enable`, and this file's `config` is gated on the same predicate, so any host that evaluates the conditional has already failed the assertion. Worse than dead, it read as a second supported spelling of a hive's identity — which is what a cert-auth role matches on. It was not even the hive's own domain: `cfg` here is `services.hyperhive.swarm.bao`, so the fallback resolved to the store's address, one string shared by every hive in the swarm and the same CN the server leaf carries. Reading the option directly matches what other modules needing the name already do (`hive-c0re/environment.nix`). --- nix/host-modules/glue-bao-tls.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nix/host-modules/glue-bao-tls.nix b/nix/host-modules/glue-bao-tls.nix index 4a4aff4f..18549577 100644 --- a/nix/host-modules/glue-bao-tls.nix +++ b/nix/host-modules/glue-bao-tls.nix @@ -43,7 +43,10 @@ let # What a reader calls itself to the store. The hive's name, because a bao # cert-auth role matches on the CN — this is an interface, not a label. - clientCn = if hyperhiveCfg.hiveName != null then hyperhiveCfg.hiveName else cfg.domain; + # No fallback: `hiveName` is asserted set for every hyperhive host, which is + # the same condition this file's `config` is gated on. A fallback here reads + # as a second supported spelling and there is no such thing. + clientCn = hyperhiveCfg.hiveName; # $1 dir $2 basename $3 CN $4 SAN or "" $5 EKU signLeaf = pkgs.writeShellScript "swarm-bao-sign-leaf" ''