vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: move the controllers' CA env settings into glue

Browse source
This commit is contained in:
atlas 2026-10-17 15:49:19 +02:00 • committed by mara
commit e21a03d6ff
7 changed files with 85 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nix/module-eval/hive-tls.nix
View file

@ -684,6 +684,30 @@ let
&& (t.timerConfig.Unit or "hive-tls-resign.service") == "hive-tls-resign.service"
&& !(remainsAfterExit leafUnit);
}
{
# ./glue-hive-tls-controllers.nix. The controllers are gated apart: the
# hive host without the swarm controller sets the first two only, and a
# gateway with neither sets none. The first arm is the presence control.
name = "the trust bundle reaches each controller's environment only where that controller runs";
ok =
let
bundle = "/var/lib/hive-tls/trust-bundle.pem";
envOf = m: unit: m.systemd.services.${unit}.environment or { };
hiveVars = [
"HIVE_TLS_CA_PATH"
"HIVE_C0RE_OIDC_CA_FILE"
];
anyOf =
m: unit: vars:
lib.any (v: (envOf m unit) ? ${v}) vars;
in
lib.all (v: (envOf allLocal "hive-c0re").${v} == bundle) hiveVars
&& (envOf allLocal "swarm-controller").SWARM_CONTROLLER_OIDC_CA_FILE == bundle
&& lib.all (v: (envOf noService "hive-c0re").${v} == bundle) hiveVars
&& !(anyOf noService "swarm-controller" [ "SWARM_CONTROLLER_OIDC_CA_FILE" ])
&& !(anyOf gatewayNoHive "hive-c0re" hiveVars)
&& !(anyOf gatewayNoHive "swarm-controller" [ "SWARM_CONTROLLER_OIDC_CA_FILE" ]);
}
{
# A oneshot has no start timeout by default, so an attempt that never
# ends never fails into a retry.