vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Compare commits

base: vinzenz:8371e1ca620df197cb2d628a6773da4c62f32cd1
Branches Tags
vinzenz:main
..
compare: vinzenz:c1b7be1135127d890e431eaa45840a9a1bb2e6d4
Branches Tags
vinzenz:main
2 changed files with 17 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nix/host-modules/glue-matrix-bao-token.nix
View file

@ -70,10 +70,6 @@ in
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
# What actually bounds the read below. Stated here rather than
# left to systemd's default, so the number a boot waits on is in
# the file that waits.
TimeoutStartSec = 30;
}; };
environment = { environment = {
BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}"; BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
@ -84,11 +80,9 @@ in
script = '' script = ''
set -euo pipefail set -euo pipefail
# A sealed or uninitialised store answers on the port and never # A sealed or uninitialised store answers on the port and times out on
# answers the read, so "the store is up" is not the same as "the # every read, so "the store is up" is not the same as "the store can
# store can answer". `TimeoutStartSec` above is the bound; the # answer" -- bound the wait rather than hanging the boot behind it.
# homeserver only `Wants=` this unit, so hitting it degrades to
# keeping the local token rather than holding up the container.
if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then
echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2 echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2
echo "Keeping the token hive-matrix already has." >&2 echo "Keeping the token hive-matrix already has." >&2

38
nix/host-modules/swarm-bao.nix
View file

@ -23,8 +23,8 @@
# distribute: reach the store to get the CA material, need a cert from that CA # distribute: reach the store to get the CA material, need a cert from that CA
# to reach the store. Service↔store mTLS is therefore its own trust domain, # to reach the store. Service↔store mTLS is therefore its own trust domain,
# separate from the gateway's HTTPS certificates and from both CAs in this # separate from the gateway's HTTPS certificates and from both CAs in this
# tree. The cert paths are inputs this module declares no default for and never # tree. The cert paths are inputs with no defaults and nothing here fills them
# fills in; a glue module mints that identity and points them at it. # in; whatever comes to mint that identity is what they will point at.
{ {
pkgs, pkgs,
lib, lib,
@ -199,13 +199,10 @@ in
Certificate the store serves, covering Certificate the store serves, covering
{option}`services.hyperhive.swarm.bao.domain`. {option}`services.hyperhive.swarm.bao.domain`.
This module declares no default and deliberately does not know No default, and this module deliberately does not know what could
what could provide one — for the same reason provide one — for the same reason
{option}`services.hyperhive.deploy.bao.clientCaFile` doesn't: the {option}`services.hyperhive.deploy.bao.clientCaFile` doesn't. The
store never reaches for an authority. deployment names the file; the store never reaches for an authority.
On a hive that runs the store, a glue module supplies a path as a
`mkDefault`, so naming your own here wins over it.
A path, never a value. A path, never a value.
''; '';
@ -229,14 +226,11 @@ in
description = '' description = ''
Authority the store validates hive **client** certificates against. Authority the store validates hive **client** certificates against.
This module declares no default and does not reach for the hive Deliberately has no default, and does not reach for the hive CA:
CA: the hive CA is a future *consumer* of the store, so a store the hive CA is a future *consumer* of the store, so a store that
that authenticated against it could not come up before the thing authenticated against it could not come up before the thing it
it issues. issues. It is a value someone points at — the swarm root for a
swarm that runs one, an operator's own CA otherwise.
On a hive that runs the store, a glue module supplies the CA it
minted for exactly this, as a `mkDefault`. Point this at something
else — the swarm root, an operator's own CA — and yours wins.
`null` leaves client-certificate verification off, which is only `null` leaves client-certificate verification off, which is only
appropriate where something else authenticates the connection. appropriate where something else authenticates the connection.
@ -334,14 +328,10 @@ in
The swarm secret store has no server certificate: set both The swarm secret store has no server certificate: set both
services.hyperhive.deploy.bao.serverCertFile and .serverKeyFile. services.hyperhive.deploy.bao.serverCertFile and .serverKeyFile.
This module defaults neither, on purpose — a store must not Nothing defaults them, on purpose — a store must not take its
take its identity from an authority it will itself distribute, identity from an authority it will itself distribute, and
and service-to-store mTLS is a separate trust domain from the service-to-store mTLS is a separate trust domain from the
gateway's certificates and from either CA in this tree. gateway's certificates and from either CA in this tree.
A hive that runs the store normally gets both from a glue
module, so reaching this means that glue is absent or
something set these back to null.
''; '';
} }
]; ];