refactor: jq for tea-login, build-time avatar png, shared leaf-sign script

nix/host-modules/hive-tls.nix

@@ -18,6 +18,46 @@ let
   # module's single source of truth (`gateway.useSelfSigned`): true when
   # neither an operator cert (`tls.certDir`) nor ACME is set.
   active = hyperhiveCfg.enable && gatewayCfg.useSelfSigned;
+
+  # The leaf-signing action shared by the boot-time `hive-tls-ca`
+  # generation and the weekly `hive-tls-resign` renewal: fresh key +
+  # CSR, SAN ext-file, sign under the (stable) CA, tighten modes.
+  # Takes the TLS state dir as `$1`; each caller keeps its own
+  # when-to-sign condition. The leaf covers the bare hive domain plus
+  # `forge.`, `matrix.` and `*.<domain>` so all sub-domains validate
+  # under the same cert + the hive CA.
+  signLeafScript = pkgs.writeShellScript "hive-tls-sign-leaf" ''
+    set -euo pipefail
+    d="$1"
+    ca="$d/ca.pem"
+    cak="$d/ca-key.pem"
+    leaf="$d/gateway.pem"
+    leafk="$d/gateway-key.pem"
+    csr="$(mktemp "$d/gateway.csr.XXXXXX")"
+    ext="$(mktemp "$d/leaf.ext.XXXXXX")"
+    trap 'rm -f "$csr" "$ext"' EXIT
+
+    openssl req -newkey rsa:4096 -nodes -sha256 \
+      -keyout "$leafk" -out "$csr" \
+      -subj "/CN=${domain}"
+
+    # printf (not a heredoc) so the ext-file lines carry no leading
+    # whitespace once nix has stripped the indented-string indent.
+    {
+      printf 'subjectAltName=DNS:%s,DNS:forge.%s,DNS:matrix.%s,DNS:*.%s\n' \
+        ${lib.escapeShellArg domain} ${lib.escapeShellArg domain} \
+        ${lib.escapeShellArg domain} ${lib.escapeShellArg domain}
+      printf 'basicConstraints=critical,CA:FALSE\n'
+      printf 'keyUsage=critical,digitalSignature,keyEncipherment\n'
+      printf 'extendedKeyUsage=serverAuth\n'
+    } > "$ext"
+
+    openssl x509 -req -in "$csr" -CA "$ca" -CAkey "$cak" \
+      -CAcreateserial -days ${toString cfg.leafValidityDays} -sha256 \
+      -extfile "$ext" -out "$leaf"
+    chmod 0600 "$leafk"
+    chmod 0644 "$leaf"
+  '';
 in
 {
   # Host-side TLS trust root for the self-signed gateway mode.
@@ -132,30 +172,7 @@ in
         if [ ! -s "$leaf" ] || [ ! -s "$leafk" ] \
             || ! openssl x509 -in "$leaf" -noout -checkend 2592000 >/dev/null 2>&1; then
           echo "signing fresh gateway leaf at $leaf"
-          csr="$(mktemp "$d/gateway.csr.XXXXXX")"
-          ext="$(mktemp "$d/leaf.ext.XXXXXX")"
-          trap 'rm -f "$csr" "$ext"' EXIT
-
-          openssl req -newkey rsa:4096 -nodes -sha256 \
-            -keyout "$leafk" -out "$csr" \
-            -subj "/CN=${domain}"
-
-          # printf (not a heredoc) so the ext-file lines carry no leading
-          # whitespace once nix has stripped the indented-string indent.
-          {
-            printf 'subjectAltName=DNS:%s,DNS:forge.%s,DNS:matrix.%s,DNS:*.%s\n' \
-              ${lib.escapeShellArg domain} ${lib.escapeShellArg domain} \
-              ${lib.escapeShellArg domain} ${lib.escapeShellArg domain}
-            printf 'basicConstraints=critical,CA:FALSE\n'
-            printf 'keyUsage=critical,digitalSignature,keyEncipherment\n'
-            printf 'extendedKeyUsage=serverAuth\n'
-          } > "$ext"
-
-          openssl x509 -req -in "$csr" -CA "$ca" -CAkey "$cak" \
-            -CAcreateserial -days ${toString cfg.leafValidityDays} -sha256 \
-            -extfile "$ext" -out "$leaf"
-          chmod 0600 "$leafk"
-          chmod 0644 "$leaf"
+          ${signLeafScript} "$d"
         fi
       '';
     };
@@ -200,10 +217,7 @@ in
       script = ''
         set -euo pipefail
         d=${lib.escapeShellArg cfg.stateDir}
-        ca="$d/ca.pem"
-        cak="$d/ca-key.pem"
         leaf="$d/gateway.pem"
-        leafk="$d/gateway-key.pem"
 
         # Re-sign only when the leaf is within half its validity of expiry.
         # The weekly cadence catches this window well before the leaf lapses.
@@ -217,28 +231,7 @@ in
         echo "gateway leaf missing or near expiry — re-signing under current CA"
         before="$(sha256sum "$leaf" 2>/dev/null || true)"
 
-        csr="$(mktemp "$d/gateway.csr.XXXXXX")"
-        ext="$(mktemp "$d/leaf.ext.XXXXXX")"
-        trap 'rm -f "$csr" "$ext"' EXIT
-
-        openssl req -newkey rsa:4096 -nodes -sha256 \
-          -keyout "$leafk" -out "$csr" \
-          -subj "/CN=${domain}"
-
-        {
-          printf 'subjectAltName=DNS:%s,DNS:forge.%s,DNS:matrix.%s,DNS:*.%s\n' \
-            ${lib.escapeShellArg domain} ${lib.escapeShellArg domain} \
-            ${lib.escapeShellArg domain} ${lib.escapeShellArg domain}
-          printf 'basicConstraints=critical,CA:FALSE\n'
-          printf 'keyUsage=critical,digitalSignature,keyEncipherment\n'
-          printf 'extendedKeyUsage=serverAuth\n'
-        } > "$ext"
-
-        openssl x509 -req -in "$csr" -CA "$ca" -CAkey "$cak" \
-          -CAcreateserial -days ${toString cfg.leafValidityDays} -sha256 \
-          -extfile "$ext" -out "$leaf"
-        chmod 0600 "$leafk"
-        chmod 0644 "$leaf"
+        ${signLeafScript} "$d"
 
         after="$(sha256sum "$leaf" 2>/dev/null || true)"
         if [ "$before" != "$after" ]; then