vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Compare commits

base: vinzenz:4e4e9f8a60e4a8bfcd541d79caf8fb156f1e1bcc
Branches Tags
vinzenz:main
..
compare: vinzenz:9634327b592886bc63c6aa72bc376f5cf5cc733f
Branches Tags
vinzenz:main
1 changed files with 7 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nix/modules/hive-tls.nix
View file

@ -63,22 +63,14 @@ in
leafValidityDays = lib.mkOption { leafValidityDays = lib.mkOption {
type = lib.types.int; type = lib.types.int;
default = 30; default = 3650;
description = '' description = ''
Validity window of the gateway leaf cert in days (default 30). Validity window of the gateway leaf cert in days (default ~10y).
Short-lived by design — ahead of the CA/Browser-Forum's move The leaf is re-signed by the (stable) CA when it is missing or
toward ~47-day max lifetimes — which bounds the blast radius of a within 30 days of expiry; because it shares the CA anchor, a
leaf-key compromise. The leaf is re-signed by the (stable) CA rotation does not disturb consumer trust. Browsers may warn on
when it is missing or near expiry; because it shares the CA long-lived leaves, but agents and federation peers validate
anchor, a rotation does not disturb consumer trust. Agents and against the CA, not browser CA/B-forum limits.
federation peers validate against the CA, not browser CA/B-forum
limits. NOTE: at this short a window the re-sign must run more
often than the leaf lifetime. Today `hive-tls-ca` re-signs at
service activation (boot/rebuild) only — there is no periodic
re-sign timer yet — so a hive that does not reboot within the
validity window would let the leaf expire. Keep that in mind (or
add a re-sign timer) when running a hive that stays up for long
stretches without a rebuild.
''; '';
}; };
}; };