vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: move the controllers' CA env settings into glue

Browse source
This commit is contained in:
atlas 2026-10-17 15:49:19 +02:00 • committed by mara
commit e21a03d6ff
7 changed files with 85 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

36
nix/host-modules/hive-tls.nix
View file

@ -929,41 +929,5 @@ in
Persistent = true;
};
};
# Signal the hive-c0re lifecycle that a trust bundle exists: it bind-mounts
# this file (read-only, public certs ONLY — never a key) into each
# agent container so agents + their tools can trust the gateway's
# self-signed leaf, and the meta flake wires the per-agent trust
# bundle. No key path is ever exposed (an agent that could read one
# could mint trusted certs).
#
# ⚠️ Every line here that names another daemon's unit is gated on that
# daemon's own enable: the gateway also runs on hosts with no hive and no
# controller, and defining an environment key on a unit that does not
# exist CREATES a unit fragment for it — inert (no `ExecStart`, empty
# `wantedBy`, never activated), and it evaluates and builds clean.
systemd.services.hive-c0re.environment.HIVE_TLS_CA_PATH =
lib.mkIf hyperhiveCfg.deploy.hive-controller.enable "${cfg.stateDir}/trust-bundle.pem";
# The same anchor, named for the swarm-queue clients that need it when
# they mint a token from authelia over TLS. Declared HERE, beside the
# bundle, rather than in each consumer's module: the path is this
# module's fact, and two consumers re-deriving `${stateDir}/…` would be
# two places to fix when it changes.
#
# ⚠️ `swarm-queue-client` builds a bare `reqwest::Client`, so it trusts
# only the platform roots and dies at `invalid peer certificate:
# UnknownIssuer` against a swarm whose authelia is signed by the swarm
# CA. The bundle is already assembled on disk and handed to hive-c0re
# under a different variable name; this declaration is what points the
# queue client at it.
#
# Where the gateway is not self-signed this module contributes nothing, and
# the clients then fall back to the platform roots — which is correct for
# a swarm fronted by a public certificate.
systemd.services.hive-c0re.environment.HIVE_C0RE_OIDC_CA_FILE =
lib.mkIf hyperhiveCfg.deploy.hive-controller.enable "${cfg.stateDir}/trust-bundle.pem";
systemd.services.swarm-controller.environment.SWARM_CONTROLLER_OIDC_CA_FILE =
lib.mkIf hyperhiveCfg.deploy.swarm-controller.enable "${cfg.stateDir}/trust-bundle.pem";
};
}