54 lines
2.3 KiB
Nix
54 lines
2.3 KiB
Nix
# Glue: point the swarm controller at the bao leaf minted for it.
|
|
#
|
|
# ONE PAIRING PER FILE — controller ← bao, and nothing else. Deleting this
|
|
# leaves a controller that takes operator-provided certificate paths, which is
|
|
# what every deployment that does not mint its own already does.
|
|
#
|
|
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
|
|
# leaf, because the thing that owns a private key owns issuing from it; a
|
|
# second signer would duplicate that file's `openssl` helper to no benefit.
|
|
# What belongs here is the pairing: which paths this host's controller reads.
|
|
#
|
|
# ⚠️ Gated on a PKI directory existing (the store runs here, or the operator
|
|
# named a reader leaf), not on the store alone. A controller on the store's own
|
|
# host is one deployment; a controller three networks away holding a leaf
|
|
# issued out of band is another, and both want the same wiring.
|
|
#
|
|
# Everything is `mkDefault`. An operator naming their own paths wins.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
baoDeploy = deployCfg.bao;
|
|
|
|
# Where ./glue-bao-tls.nix puts the leaves. An operator's own `clientCertFile`
|
|
# names the directory when one is set (an operator who moves the PKI moves
|
|
# both, and the two cannot drift apart); on a store host that runs no hive
|
|
# there is no reader leaf to derive from, so it is the store's directory.
|
|
haveMintedPki = baoDeploy.clientCertFile != null || baoDeploy.enable;
|
|
pkiDir =
|
|
if baoDeploy.clientCertFile != null then
|
|
builtins.dirOf baoDeploy.clientCertFile
|
|
else if baoDeploy.enable then
|
|
import ./lib/bao-pki-dir.nix
|
|
else
|
|
null;
|
|
in
|
|
{
|
|
config = lib.mkIf (deployCfg.swarm-controller.enable && haveMintedPki) {
|
|
services.hyperhive.deploy.swarm-controller = {
|
|
baoClientCertFile = lib.mkDefault "${pkiDir}/controller.pem";
|
|
baoClientKeyFile = lib.mkDefault "${pkiDir}/controller-key.pem";
|
|
}
|
|
// lib.optionalAttrs (baoDeploy.clientCaFile != null) {
|
|
# The authority the store already trusts hives by, handed to the daemon
|
|
# that has to write it into each hive's role. One file, two readers —
|
|
# a second copy would authenticate hives the store does not.
|
|
hiveClientCaFile = lib.mkDefault baoDeploy.clientCaFile;
|
|
};
|
|
};
|
|
}
|