vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

fetch the self-check's password as a systemd credential

Browse source
This commit is contained in:
atlas 2026-10-28 13:07:15 +01:00 • committed by mara
commit fd63b402e1
1 changed files with 146 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/host-modules/swarm-bao.nix
View file

@ -942,12 +942,13 @@ let
inherit hiveName;
}) hyperhiveCfg.swarm.hives;
# What a hive's gateway-leaf identity may do: issue from its own role, and
# read two of its own cache facts. The root unit on the hive host
# (`hive-priv-cache-facts`, ./hive-priv-cache.nix) reads them under this
# identity: the key hive-priv's downloads must be signed by, and the token it
# pulls with. The cache's URL and name come from the host's configuration,
# not from the store.
# What a hive's gateway-leaf identity may do: issue from its own role, read
# two of its own cache facts, and read its own squid self-check credential.
# The root unit on the hive host (`hive-priv-cache-facts`,
# ./hive-priv-cache.nix) reads the facts under this identity: the key
# hive-priv's downloads must be signed by, and the token it pulls with. The
# cache's URL and name come from the host's configuration, not from the
# store. `squid-selfcheck-credential` (./hive-squid.nix) reads the credential.
hiveLeafPolicyText =
obj:
''
@ -961,7 +962,8 @@ let
[
"public-key"
"pull-token"
];
]
+ readStanza "${credentialMountPath}/data/swarm/hives/${obj.hiveName}/squid-selfcheck";
# The PKI mount agent client certificates are issued from. Its root is
# generated inside the store, so the agent CA's key never exists outside it.