agents fetch the hive CA from bao at boot instead of the meta flake embedding it

2026-10-19 18:46:34 +02:00 · 2026-10-19 18:46:34 +02:00 · d547b521f6
commit d547b521f6
parent 0831b85b73
12 changed files with 329 additions and 246 deletions
--- a/nix/module-eval/hive-tls.nix
+++ b/nix/module-eval/hive-tls.nix
@ -693,10 +693,7 @@ let
        let
          bundle = "/var/lib/hive-tls/trust-bundle.pem";
          envOf = m: unit: m.systemd.services.${unit}.environment or { };
-          hiveVars = [
-            "HIVE_TLS_CA_PATH"
-            "HIVE_C0RE_OIDC_CA_FILE"
-          ];
+          hiveVars = [ "HIVE_C0RE_OIDC_CA_FILE" ];
          anyOf =
            m: unit: vars:
            lib.any (v: (envOf m unit) ? ${v}) vars;