vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

outlast openbao's cold restart in the agent ca unit's start limit

Browse source
This commit is contained in:
atlas 2026-11-01 15:09:13 +01:00
commit c273527219
1 changed files with 21 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/module-eval/bao-basics.nix
View file

@ -255,6 +255,20 @@ let
&& !(lib.hasInfix "certificate=@${tlsDir}/listener-client-ca.pem" scripts)
&& !(lib.hasInfix "certificate=@${tlsDir}/agent-ca.pem" scripts);
}
{
# The unit's blocking `systemctl restart openbao.service` stops (90 s)
# then starts openbao (240 s), so its own limit must exceed both or a
# slow cold open kills the job mid-restart. Control: openbao's own limit
# is read from the same container, so a wrong path fails the 240 arm.
name = "the agent CA unit's start limit outlasts the restart of openbao it waits on";
ok =
let
limit = lib.toInt (
lib.removeSuffix "s" baoPkcs11.systemd.services.swarm-bao-agent-pki.serviceConfig.TimeoutStartSec
);
in
(baoUnits baoPkcs11).openbao.serviceConfig.TimeoutStartSec == 240 && limit >= 90 + 240 + 60;
}
{
# Both writers compose the bundle through one function, which refuses
# a result that does not begin with the store CA and replaces the file