4e5a642928
The gateway leaf comes from the store's pki mount, so a hive CA's certificates anchor nothing and its key is a secret outside the store. - hive-tls-ca writes trust-bundle.pem from swarm-services-root.pem alone; the ca.pem and ca-previous.pem slots are gone. - Every host deletes ca.pem, ca-previous.pem and ca-key.pem in deploy.hive-controller.tls.stateDir with tmpfiles `r` rules that follow the option. The removal shim, now host-ca-removed.nix, holds these beside the /var/lib/swarm-ca rule and the swarm.ca.* removals. - deploy.bao.clientCaFile, deploy.bao.serverCaFile and deploy.swarm-controller.hiveClientCaFile naming /var/lib/swarm-ca or one of the deleted hive CA files fail evaluation, naming the store's mTLS CA (/var/lib/swarm-bao-pki/ca.pem on the store's host) as the replacement. module-eval hive-tls covers the single-anchor bundle, the deletion (incl. a relocated stateDir) and the assertion on all three options. Refs #4588
65 lines
2.7 KiB
Nix
65 lines
2.7 KiB
Nix
# Removal shim for the CAs a host held outside the secret store: the
|
|
# swarm root under `/var/lib/swarm-ca` (and its `services.hyperhive.swarm.ca.*`
|
|
# options), and a hive CA's `ca.pem`, `ca-previous.pem` and `ca-key.pem` in
|
|
# `deploy.hive-controller.tls.stateDir`.
|
|
#
|
|
# The secret store's `pki` root is the only trust anchor: it issues every
|
|
# hive's gateway leaf and the swarm's service names, and its key never leaves
|
|
# the store. Nothing generates, reads or bundles either CA, so a definition of
|
|
# a removed option fails evaluation with a message, a CA-file option naming
|
|
# one of the deleted paths fails it too, and every host deletes the files.
|
|
#
|
|
# Self-contained and deletable, like ./swarm-peers-removed.nix: one file to
|
|
# remove when the deprecation window closes.
|
|
{ lib, config, ... }:
|
|
let
|
|
deployCfg = config.services.hyperhive.deploy;
|
|
|
|
swarmCaDir = "/var/lib/swarm-ca";
|
|
hiveCaFiles = map (f: "${deployCfg.hive-controller.tls.stateDir}/${f}") [
|
|
"ca.pem"
|
|
"ca-previous.pem"
|
|
"ca-key.pem"
|
|
];
|
|
deleted = p: p == swarmCaDir || lib.hasPrefix "${swarmCaDir}/" p || lib.elem p hiveCaFiles;
|
|
|
|
# Every option that names a CA the store's mTLS checks against. One
|
|
# pointing at a deleted file fails the unit that reads it at start.
|
|
caFileOptions = {
|
|
"services.hyperhive.deploy.bao.clientCaFile" = deployCfg.bao.clientCaFile;
|
|
"services.hyperhive.deploy.bao.serverCaFile" = deployCfg.bao.serverCaFile;
|
|
"services.hyperhive.deploy.swarm-controller.hiveClientCaFile" =
|
|
deployCfg.swarm-controller.hiveClientCaFile;
|
|
};
|
|
|
|
removed =
|
|
name:
|
|
lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "ca" name ] ''
|
|
The host-held swarm root CA is gone: the secret store's pki root is the
|
|
only trust anchor, and nothing generates or reads a root under
|
|
${swarmCaDir}. Remove this definition. See docs/swarm/ca.md.
|
|
'';
|
|
in
|
|
{
|
|
imports = map removed [
|
|
"autoConfigure"
|
|
"stateDir"
|
|
"validityDays"
|
|
];
|
|
|
|
assertions = lib.mapAttrsToList (option: path: {
|
|
assertion = path == null || !(deleted path);
|
|
message = ''
|
|
${option} is ${toString path}, a file every host deletes along with
|
|
the host-held CA it belonged to. Point it at the store's mTLS CA:
|
|
/var/lib/swarm-bao-pki/ca.pem on the host that runs the store, the copy
|
|
placed by hand on any other host. See docs/swarm/ca.md.
|
|
'';
|
|
}) caFileOptions;
|
|
|
|
# Both CAs' private keys are secrets outside the store, and the
|
|
# certificates beside them are anchors nothing issues under. The swarm
|
|
# root at the option's old default path only: a relocated `stateDir` is
|
|
# the operator's to delete.
|
|
systemd.tmpfiles.rules = [ "R ${swarmCaDir}" ] ++ map (f: "r ${f}") hiveCaFiles;
|
|
}
|