vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

fetch the self-check's password as a systemd credential

Browse source
This commit is contained in:
atlas 2026-10-28 13:07:15 +01:00 • committed by mara
commit fd63b402e1
2 changed files with 146 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/module-eval/bao-grants.nix
View file

@ -1496,9 +1496,10 @@ let
{
# One role, policy and login role per hive in the directory, each
# naming only its own hive: the policy text in the unit is exactly the
# `update` on its own role and `read` on its own two cache facts, and each
# `update` on its own role and `read` on its own two cache facts and its own
# squid self-check credential, and each
# hive's block names neither the other's role nor its subject.
name = "each hive's gateway-leaf identity may issue from its own role and read its own two cache facts, and nothing else";
name = "each hive's gateway-leaf identity may issue from its own role and read its own two cache facts and squid self-check credential, and nothing else";
ok =
let
s = baoGrantTwoHives.systemd.services.swarm-bao-hive-leaf-policy.script;
@ -1536,6 +1537,10 @@ let
path = "secret/data/swarm/hives/h1/attic/pull-token";
caps = [ "read" ];
}
{
path = "secret/data/swarm/hives/h1/squid-selfcheck";
caps = [ "read" ];
}
{
path = "pki/issue/swarm-hive-leaf-h2";
caps = [ "update" ];
@ -1548,6 +1553,10 @@ let
path = "secret/data/swarm/hives/h2/attic/pull-token";
caps = [ "read" ];
}
{
path = "secret/data/swarm/hives/h2/squid-selfcheck";
caps = [ "read" ];
}
]
&& issues "h1" "h1.t.local" h1
&& issues "h2" "h2.example.org" h2

22
nix/module-eval/hive-tls.nix
View file

@ -800,6 +800,28 @@ let
noService.systemd.services.hive-priv-cache-facts.environment.BAO_CLIENT_CERT
== "/etc/pki/bao-hive.pem";
}
{
# Control: the lookup finds the sibling root unit of the same shape. The
# squid self-check's password is read under this hive's own identity and
# lands where only root reads it, as the credential `squid-selfcheck`
# imports.
name = "the squid self-check credential is read by a root oneshot under this hive's own identity into the credstore";
ok =
let
u = units.squid-selfcheck-credential;
in
lib.hasInfix "secret/swarm/hives/h1/squid-selfcheck" u.script
&& !(lib.hasInfix "swarm/hives/h2" u.script)
&& lib.hasInfix "/run/credstore/hive-squid.selfcheck" u.script
&& lib.hasInfix "atomic_write_secret 0400 root:root" u.script
&& u.environment.BAO_CLIENT_CERT == units.hive-priv-cache-facts.environment.BAO_CLIENT_CERT
&& u.environment.BAO_CLIENT_KEY == units.hive-priv-cache-facts.environment.BAO_CLIENT_KEY
&& u.serviceConfig.Type == "oneshot"
&& !(remainsAfterExit u)
&& allLocal.systemd.timers ? squid-selfcheck-credential
&& !(noIdentity.systemd.services ? squid-selfcheck-credential)
&& !(noIdentity.systemd.timers ? squid-selfcheck-credential);
}
{
name = "hive-priv is told the cache's address by the host's configuration";
ok =