vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents fetch the hive CA from bao at boot instead of the meta flake embedding it

Browse source
This commit is contained in:
atlas 2026-10-19 18:46:34 +02:00 • committed by mara
commit d547b521f6
12 changed files with 329 additions and 246 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/host-modules/glue-hive-tls-controllers.nix
View file

@ -2,13 +2,10 @@
#
# ONE PAIRING PER FILE — hive-c0re and the swarm controller ← the trust bundle
# ./hive-tls.nix assembles. Deleting this leaves daemons that trust only the
# platform roots: hive-c0re's lifecycle cannot hand agents the bundle, and the
# swarm-queue clients die at `invalid peer certificate: UnknownIssuer` against
# an authelia signed by the swarm CA.
# platform roots: the swarm-queue clients die at
# `invalid peer certificate: UnknownIssuer` against an authelia signed by the
# swarm CA.
#
# `HIVE_TLS_CA_PATH` signals the hive-c0re lifecycle that a trust bundle exists:
# it bind-mounts the file (read-only, public certs ONLY — never a key) into each
# agent container, and the meta flake wires the per-agent trust bundle.
# `*_OIDC_CA_FILE` names the same anchor for the swarm-queue clients that mint a
# token from authelia over TLS. `swarm-queue-client` builds a bare
# `reqwest::Client`, so it trusts only the platform roots without it. Where the
@ -43,7 +40,6 @@ in
lib.mkMerge [
(lib.mkIf deployCfg.hive-controller.enable {
systemd.services.hive-c0re.environment = {
HIVE_TLS_CA_PATH = trustBundle;
HIVE_C0RE_OIDC_CA_FILE = trustBundle;
};
})

3
nix/host-modules/hive-c0re/environment.nix
View file

@ -278,6 +278,9 @@ in
# environment wholesale would inherit the hive's certificate paths with it,
# and those name a credential no agent may present.
HIVE_AGENT_BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
# The mount whose root an agent fetches to trust the swarm's services; the
# same value ../hive-tls.nix reads the root from.
HIVE_AGENT_BAO_SERVICES_PKI_MOUNT = baoDeploy.servicesPkiMountPath;
# `%d`, not the paths themselves: the key is `0600` root-owned and this
# daemon runs as hive-core, so it never gets read access to the original.
# See the LoadCredential in ./default.nix.