vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor(#2015): drop redundant domain != null checks (domain is required) + update docs

Browse source
This commit is contained in:
damocles 2026-06-26 20:43:54 +02:00 • committed by mara
commit c8ae3371e1
6 changed files with 88 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/modules/hive-tls.nix
View file

@ -12,11 +12,12 @@ let
# The host-managed hive CA is the trust anchor for self-signed mode.
# It is only stood up when the gateway actually serves a self-signed
# cert: a domain must be set (the leaf SANs derive from it) and the
# gateway must be in self-signed mode. The self-signed condition is the
# gateway module's single source of truth (`gateway.useSelfSigned`):
# true when neither an operator cert (`tls.certDir`) nor ACME is set.
active = hyperhiveCfg.enable && gatewayCfg.useSelfSigned && domain != null;
# cert: the gateway must be in self-signed mode. `domain` is required
# (asserted in hive-network.nix), so the leaf SANs always have a
# domain to derive from. The self-signed condition is the gateway
# module's single source of truth (`gateway.useSelfSigned`): true when
# neither an operator cert (`tls.certDir`) nor ACME is set.
active = hyperhiveCfg.enable && gatewayCfg.useSelfSigned;
in
{
# Host-side TLS trust root for the self-signed gateway mode.