55 lines
2.3 KiB
Nix
55 lines
2.3 KiB
Nix
# Glue: hand the hive's trust bundle to the daemons that dial the swarm over TLS.
|
|
#
|
|
# ONE PAIRING PER FILE — hive-c0re and the swarm controller ← the trust bundle
|
|
# ./hive-tls.nix assembles. Deleting this leaves daemons that trust only the
|
|
# platform roots: hive-c0re's lifecycle cannot hand agents the bundle, and the
|
|
# swarm-queue clients die at `invalid peer certificate: UnknownIssuer` against
|
|
# an authelia signed by the swarm CA.
|
|
#
|
|
# `HIVE_TLS_CA_PATH` signals the hive-c0re lifecycle that a trust bundle exists:
|
|
# it bind-mounts the file (read-only, public certs ONLY — never a key) into each
|
|
# agent container, and the meta flake wires the per-agent trust bundle.
|
|
# `*_OIDC_CA_FILE` names the same anchor for the swarm-queue clients that mint a
|
|
# token from authelia over TLS. `swarm-queue-client` builds a bare
|
|
# `reqwest::Client`, so it trusts only the platform roots without it. Where the
|
|
# gateway is not self-signed ./hive-tls.nix contributes no bundle and nothing is
|
|
# set here, which is correct for a swarm fronted by a public certificate.
|
|
#
|
|
# ⚠️ One gate per daemon, each ANDed with the bundle existing: the gateway also
|
|
# runs on hosts with no hive and no controller, and defining an environment key
|
|
# on a unit that does not exist CREATES a unit fragment for it — inert (no
|
|
# `ExecStart`, empty `wantedBy`, never activated), and it evaluates and builds
|
|
# clean.
|
|
#
|
|
# ⚠️ Files like this are the only place a `deploy.<foo>` value may derive from
|
|
# a `deploy.<bar>.enable`. Everywhere else that is forbidden.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
gatewayCfg = hyperhiveCfg.gateway;
|
|
|
|
# ./hive-tls.nix writes the bundle only where the gateway serves its own
|
|
# self-signed cert.
|
|
haveBundle = gatewayCfg.enable && gatewayCfg.useSelfSigned;
|
|
trustBundle = "${deployCfg.hive-controller.tls.stateDir}/trust-bundle.pem";
|
|
in
|
|
{
|
|
config = lib.mkIf haveBundle (
|
|
lib.mkMerge [
|
|
(lib.mkIf deployCfg.hive-controller.enable {
|
|
systemd.services.hive-c0re.environment = {
|
|
HIVE_TLS_CA_PATH = trustBundle;
|
|
HIVE_C0RE_OIDC_CA_FILE = trustBundle;
|
|
};
|
|
})
|
|
(lib.mkIf deployCfg.swarm-controller.enable {
|
|
systemd.services.swarm-controller.environment.SWARM_CONTROLLER_OIDC_CA_FILE = trustBundle;
|
|
})
|
|
]
|
|
);
|
|
}
|