3202cde704
`services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone. One switch, `services.hyperhive.deploy.hive-controller.enable` (default false, as the old toggle was), now gates hive-c0re and hive-priv. Both old paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config that still sets either evaluates as before and gets a rename warning. Every other read of the old toggle is resolved, including the 29 made through the `hyperhiveCfg`/`hiveCfg` aliases: - Dropped: each swarm service and its glue keeps only its own deploy toggle (authelia, bao and its PKI glue, grafana, victorialogs, victoriametrics, the secret publisher, swarm-ca, the OIDC client rows, the controller/nats/matrix-ctl/publisher/services-issuer identities), the forge, and the `domain` deprecation warning. - To deploy.hive-controller.enable: the queue-agent credential reader and its assertion, which feed hive-c0re and write under its state dir, plus their policy-order entry; the network identity assertions; hive-tls's two writes into hive-c0re's environment. - hive-tls runs where the gateway runs self-signed (`gateway.enable && useSelfSigned`), not on every host. - The matrix appservice-token reader and its assertion stay on `deploy.matrix.enable` plus their client-identity checks. They read deploy.matrix's token file and registration script; their deploy.bao inputs are the client-half options a hive sets to read a store it does not run, so gating on deploy.bao.enable would drop the tested remote-reader case. - The `hiveName` assertion moves from hive-network.nix to hyperhive.nix and fires wherever the hive, the store or the homeserver runs: each turns the name into an identifier with no fallback. On a host with `deploy.allSwarmServices` and no hive, the documented services-host recipe, authelia, bao, grafana, victorialogs, victoriametrics, the OIDC client rows and the hive CA now render; before, the old toggle being off left them out. Refs #4500
47 lines
2.1 KiB
Nix
47 lines
2.1 KiB
Nix
# Glue: point the swarm controller at the bao leaf minted for it.
|
|
#
|
|
# ONE PAIRING PER FILE — controller ← bao, and nothing else. Deleting this
|
|
# leaves a controller that takes operator-provided certificate paths, which is
|
|
# what every deployment that does not mint its own already does.
|
|
#
|
|
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
|
|
# leaf, because the thing that owns a private key owns issuing from it; a
|
|
# second signer would duplicate that file's `openssl` helper to no benefit.
|
|
# What belongs here is the pairing: which paths this host's controller reads.
|
|
#
|
|
# ⚠️ Gated on the leaf existing, not on the store being enabled. A controller
|
|
# on the store's own host is one deployment; a controller three networks away
|
|
# holding a leaf issued out of band is another, and both want the same wiring.
|
|
# `deploy.bao.enable` would have made the first one the only supported shape.
|
|
#
|
|
# Everything is `mkDefault`. An operator naming their own paths wins.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
baoDeploy = deployCfg.bao;
|
|
|
|
# Where ./glue-bao-tls.nix puts the leaves. Derived from the reader's own
|
|
# path rather than repeating that file's directory literal: an operator who
|
|
# moves the PKI moves both, and the two cannot drift apart.
|
|
haveMintedPki = baoDeploy.clientCertFile != null;
|
|
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
|
|
in
|
|
{
|
|
config = lib.mkIf (deployCfg.swarm-controller.enable && haveMintedPki) {
|
|
services.hyperhive.deploy.swarm-controller = {
|
|
baoClientCertFile = lib.mkDefault "${pkiDir}/controller.pem";
|
|
baoClientKeyFile = lib.mkDefault "${pkiDir}/controller-key.pem";
|
|
}
|
|
// lib.optionalAttrs (baoDeploy.clientCaFile != null) {
|
|
# The authority the store already trusts hives by, handed to the daemon
|
|
# that has to write it into each hive's role. One file, two readers —
|
|
# a second copy would authenticate hives the store does not.
|
|
hiveClientCaFile = lib.mkDefault baoDeploy.clientCaFile;
|
|
};
|
|
};
|
|
}
|