deploy: move the hive CA's knobs to deploy.hive-controller.tls
`services.hyperhive.tls.{stateDir,caValidityDays,leafValidityDays}` sat at
the top of `services.hyperhive`, which is meant to be everything about
hyperhive rather than the settings of one hive. Where the hive CA lives,
how long it lasts and how long the leaves it signs last are decisions of
the host holding the key — `deploy.*`, by the same rule as the switches
that moved before them.
`hive-controller` is hive-c0re's new name (mara on the issue), so the
knobs hang off the daemon that owns the CA rather than off a bare `tls`
at the root. mkRenamedOptionModule entries carry existing configs.
⚠️ Unlike the two switch renames, these names are NOT unique, so this was
swept by ALIAS BINDING rather than by identifier: hive-tls.nix alone holds
two options spelled `stateDir` — its own `cfg.stateDir` and the swarm CA's
`swarmCaCfg.stateDir`, four sites that must not move. Nine files bind an
alias to this config; the rename followed those bindings.
Two sites were invisible to the obvious check, and an unanchored sweep for
`hyperhive\.tls\b` is what found them: the option declaration (`= {` after
the path, so no trailing `.` or `;`) and the alias convention documented in
a comment in lib/hive-ca-trust.nix.
Also renamed the `<tls.stateDir>` shorthand in four docs and two Rust doc
comments, anchored on its delimiters — the new path contains the old one
as a substring, so an unanchored replace would have doubled the prefix.
This commit is contained in:
atlas
mara
parent
04f161a95b
commit
daa6eb96f8
18 changed files with 55 additions and 33 deletions
|
|
@ -129,6 +129,25 @@ in
|
|||
[ "services" "hyperhive" "enableAllLocalDefaults" ]
|
||||
[ "services" "hyperhive" "deploy" "singleHostSwarm" ]
|
||||
)
|
||||
|
||||
# The hive CA's own knobs. They sat at the TOP of `services.hyperhive`,
|
||||
# which is meant to be everything about hyperhive rather than the settings
|
||||
# of one hive — and where the CA lives, how long it lasts and how long its
|
||||
# leaves last are decisions of the host that holds the key. `hive-controller`
|
||||
# is hive-c0re's new name (mara, on the issue), so the daemon that owns the
|
||||
# CA is what they hang off.
|
||||
(lib.mkRenamedOptionModule
|
||||
[ "services" "hyperhive" "tls" "stateDir" ]
|
||||
[ "services" "hyperhive" "deploy" "hive-controller" "tls" "stateDir" ]
|
||||
)
|
||||
(lib.mkRenamedOptionModule
|
||||
[ "services" "hyperhive" "tls" "caValidityDays" ]
|
||||
[ "services" "hyperhive" "deploy" "hive-controller" "tls" "caValidityDays" ]
|
||||
)
|
||||
(lib.mkRenamedOptionModule
|
||||
[ "services" "hyperhive" "tls" "leafValidityDays" ]
|
||||
[ "services" "hyperhive" "deploy" "hive-controller" "tls" "leafValidityDays" ]
|
||||
)
|
||||
];
|
||||
|
||||
# ⚠️ `deploy.forgejo` is declared in ./hive-ci.nix, not here, and it is the
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ let
|
|||
|
||||
caTrust = import ../lib/hive-ca-trust.nix {
|
||||
inherit lib;
|
||||
tlsCfg = config.services.hyperhive.tls;
|
||||
tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
|
||||
gatewayCfg = config.services.hyperhive.gateway;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ let
|
|||
forgeCfg = config.services.hyperhive.swarm.forge;
|
||||
gatewayCfg = config.services.hyperhive.gateway;
|
||||
networkCfg = config.services.hyperhive.network;
|
||||
tlsCfg = config.services.hyperhive.tls;
|
||||
tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
|
||||
|
||||
# Self-signed TLS is the gateway default (no operator cert / ACME). When
|
||||
# active, forgejo's ROOT_URL is `https://forge.<domain>` and the leaf is
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ let
|
|||
gatewayCfg = config.services.hyperhive.gateway;
|
||||
hyperhiveDomain = config.services.hyperhive.domain;
|
||||
swarmDomain = config.services.hyperhive.swarm.domain;
|
||||
tlsCfg = config.services.hyperhive.tls;
|
||||
tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
|
||||
|
||||
# Forgejo's name for the login source. A constant, not an option: it
|
||||
# is the key this module's own idempotency check looks up, so making
|
||||
|
|
|
|||
|
|
@ -94,7 +94,7 @@ let
|
|||
# from the tls option here rather than importing that helper: this
|
||||
# is the HOST's own bundle, and the helper's job is assembling a
|
||||
# per-container copy.
|
||||
caBundle = "${config.services.hyperhive.tls.stateDir}/trust-bundle.pem";
|
||||
caBundle = "${config.services.hyperhive.deploy.hive-controller.tls.stateDir}/trust-bundle.pem";
|
||||
};
|
||||
|
||||
nginxTree = import ./vhosts.nix {
|
||||
|
|
@ -346,8 +346,8 @@ in
|
|||
# read it — a 0600 root:root key passes the master load but
|
||||
# fails the pre-start config test with `BIO_new_file() …
|
||||
# Permission denied`, blocking the unit. Cert is world-read.
|
||||
install -m 0644 ${config.services.hyperhive.tls.stateDir}/gateway.pem ${tlsCert}
|
||||
install -m 0640 -g nginx ${config.services.hyperhive.tls.stateDir}/gateway-key.pem ${tlsKey}
|
||||
install -m 0644 ${config.services.hyperhive.deploy.hive-controller.tls.stateDir}/gateway.pem ${tlsCert}
|
||||
install -m 0640 -g nginx ${config.services.hyperhive.deploy.hive-controller.tls.stateDir}/gateway-key.pem ${tlsKey}
|
||||
|
||||
# The swarm-services leaf, when this host issues one. It is
|
||||
# a separate pair rather than more SANs on the one above
|
||||
|
|
@ -372,13 +372,13 @@ in
|
|||
#
|
||||
# Measured, not theorised: this exact path took pr1ma's
|
||||
# gateway down when the services sub-CA failed to issue.
|
||||
if [ -s ${config.services.hyperhive.tls.stateDir}/swarm-services.pem ]; then
|
||||
install -m 0644 ${config.services.hyperhive.tls.stateDir}/swarm-services.pem ${svcCert}
|
||||
install -m 0640 -g nginx ${config.services.hyperhive.tls.stateDir}/swarm-services-key.pem ${svcKey}
|
||||
if [ -s ${config.services.hyperhive.deploy.hive-controller.tls.stateDir}/swarm-services.pem ]; then
|
||||
install -m 0644 ${config.services.hyperhive.deploy.hive-controller.tls.stateDir}/swarm-services.pem ${svcCert}
|
||||
install -m 0640 -g nginx ${config.services.hyperhive.deploy.hive-controller.tls.stateDir}/swarm-services-key.pem ${svcKey}
|
||||
else
|
||||
echo "no swarm-services leaf — serving the hive leaf on those names (mismatch, not an outage)" >&2
|
||||
install -m 0644 ${config.services.hyperhive.tls.stateDir}/gateway.pem ${svcCert}
|
||||
install -m 0640 -g nginx ${config.services.hyperhive.tls.stateDir}/gateway-key.pem ${svcKey}
|
||||
install -m 0644 ${config.services.hyperhive.deploy.hive-controller.tls.stateDir}/gateway.pem ${svcCert}
|
||||
install -m 0640 -g nginx ${config.services.hyperhive.deploy.hive-controller.tls.stateDir}/gateway-key.pem ${svcKey}
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
let
|
||||
cfg = config.services.hyperhive.swarm.matrix;
|
||||
networkCfg = config.services.hyperhive.network;
|
||||
tlsCfg = config.services.hyperhive.tls;
|
||||
tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
|
||||
gatewayCfg = config.services.hyperhive.gateway;
|
||||
hyperhiveDomain = config.services.hyperhive.domain;
|
||||
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.services.hyperhive.tls;
|
||||
cfg = config.services.hyperhive.deploy.hive-controller.tls;
|
||||
hyperhiveCfg = config.services.hyperhive;
|
||||
gatewayCfg = config.services.hyperhive.gateway;
|
||||
swarmCaCfg = config.services.hyperhive.swarm.ca;
|
||||
|
|
@ -287,7 +287,7 @@ in
|
|||
# everything this hive serves. Either way an existing CA is left
|
||||
# alone; see the issuance comment below.
|
||||
|
||||
options.services.hyperhive.tls = {
|
||||
options.services.hyperhive.deploy.hive-controller.tls = {
|
||||
stateDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/hive-tls";
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@
|
|||
# # systemd.services."container@hive-ci" = lib.mkMerge [ caTrust.containerOrdering … ];
|
||||
# # environment.NODE_EXTRA_CA_CERTS = caTrust.caContainerPath; # consumption, per-caller
|
||||
#
|
||||
# `tlsCfg` = config.services.hyperhive.tls
|
||||
# `tlsCfg` = config.services.hyperhive.deploy.hive-controller.tls
|
||||
# `gatewayCfg` = config.services.hyperhive.gateway
|
||||
{
|
||||
lib,
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ let
|
|||
# `opentelemetry-collector` service holding an `SSL_CERT_FILE`.
|
||||
caTrust = import ./lib/hive-ca-trust.nix {
|
||||
inherit lib;
|
||||
tlsCfg = config.services.hyperhive.tls;
|
||||
tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
|
||||
gatewayCfg = config.services.hyperhive.gateway;
|
||||
};
|
||||
in
|
||||
|
|
|
|||
|
|
@ -75,8 +75,8 @@ let
|
|||
|
||||
# Where the leaf lands for openbao to read. Inside the container, because
|
||||
# `hostStateDir` is already bind-mounted at `stateDir` — so the delivery
|
||||
# below needs no second mount, and nothing has to bind `tls.stateDir`,
|
||||
# which holds the hive CA's private key.
|
||||
# below needs no second mount, and nothing has to bind
|
||||
# `deploy.hive-controller.tls.stateDir`, which holds the hive CA's private key.
|
||||
serverCertPath = "${stateDir}/server.pem";
|
||||
serverKeyPath = "${stateDir}/server-key.pem";
|
||||
|
||||
|
|
|
|||
|
|
@ -81,10 +81,10 @@ in
|
|||
|
||||
With it off, both artifacts are operator-provided: the root
|
||||
under `stateDir`, and this hive's CA under
|
||||
`services.hyperhive.tls.stateDir`. A hive given neither keeps
|
||||
the self-signed CA it has always had — it simply isn't part of
|
||||
a swarm's trust hierarchy, which is the correct outcome for a
|
||||
hive nobody has federated yet.
|
||||
`services.hyperhive.deploy.hive-controller.tls.stateDir`. A hive
|
||||
given neither keeps the self-signed CA it has always had — it
|
||||
simply isn't part of a swarm's trust hierarchy, which is the
|
||||
correct outcome for a hive nobody has federated yet.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -126,7 +126,7 @@ in
|
|||
default = 10950;
|
||||
description = ''
|
||||
Validity window of the swarm root CA in days (default ~30y).
|
||||
Deliberately longer than `services.hyperhive.tls.caValidityDays`:
|
||||
Deliberately longer than `services.hyperhive.deploy.hive-controller.tls.caValidityDays`:
|
||||
the root must outlive the hive CAs it issues, or those chains
|
||||
expire out from under hives that are still perfectly happy with
|
||||
their own intermediate. Rotating a root is the one operation in
|
||||
|
|
|
|||
|
|
@ -52,7 +52,7 @@ let
|
|||
# phantom `swarm-controller` service holding an `SSL_CERT_FILE`.
|
||||
caTrust = import ./lib/hive-ca-trust.nix {
|
||||
inherit lib;
|
||||
tlsCfg = config.services.hyperhive.tls;
|
||||
tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
|
||||
gatewayCfg = config.services.hyperhive.gateway;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ let
|
|||
|
||||
machine = "swarm-nats";
|
||||
|
||||
tlsCfg = config.services.hyperhive.tls;
|
||||
tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
|
||||
gatewayCfg = config.services.hyperhive.gateway;
|
||||
caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
|
||||
# The responder introspects authelia over https BY NAME. Its HTTP client is
|
||||
|
|
|
|||
Loading…
Reference in a new issue