3c79c5eb5d
glue-nats-auth-bao-identity.nix defaulted deploy.nats.authBaoClient{Cert,Key}File
to a sibling of deploy.bao.clientCertFile, which is the hive's own store
reader. That tied a swarm service to a hive identity, pointed a store host
whose reader was moved at a file nobody mints, and on a queue host without
the store that held only a placed hive reader invented a nats-auth.pem path
that passed the eval assertion and failed at runtime.
The glue is now gated on the store running on this host (deploy.bao.enable,
the condition glue-bao-tls.nix mints under) and names the directory the
minting unit writes to, shared through nix/host-modules/lib/bao-pki-dir.nix.
A queue host without the store gets no default and the eval assertion
refuses it until the responder's own leaf is named; the assertion message
now names deploy.bao.enable as where the default comes from.
On a default store host the evaluated paths are unchanged:
/var/lib/swarm-bao-pki/nats-auth{,-key}.pem.
Refs #4921
32 lines
1.2 KiB
Nix
32 lines
1.2 KiB
Nix
# Glue: point the queue's auth-callout responder at the bao leaf minted for it.
|
|
#
|
|
# ONE PAIRING PER FILE — the swarm-nats-auth principal ← bao, and nothing else.
|
|
# Deleting this leaves a queue with no responder identity unless the operator
|
|
# names one, which ./swarm-nats.nix refuses at eval.
|
|
#
|
|
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
|
|
# leaf. What belongs here is the pairing: which paths the responder presents.
|
|
#
|
|
# ⚠️ Gated on the store running on this host, the only place the leaf is
|
|
# minted. Not on `deploy.bao.clientCertFile`, the hive's own reader: a queue
|
|
# host need not run a hive. A queue host without the store gets no default
|
|
# here; the operator places the responder's leaf and names it.
|
|
#
|
|
# Everything is `mkDefault`. An operator naming their own paths wins.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
deployCfg = config.services.hyperhive.deploy;
|
|
pkiDir = import ./lib/bao-pki-dir.nix;
|
|
in
|
|
{
|
|
config = lib.mkIf (deployCfg.nats.enable && deployCfg.bao.enable) {
|
|
services.hyperhive.deploy.nats = {
|
|
authBaoClientCertFile = lib.mkDefault "${pkiDir}/nats-auth.pem";
|
|
authBaoClientKeyFile = lib.mkDefault "${pkiDir}/nats-auth-key.pem";
|
|
};
|
|
};
|
|
}
|