9bbc74ee51
A CA that signs exactly two things -- the store's server certificate and the client certificate of whoever reads from it -- and distributes nothing. Not the hive CA, not the swarm CA: the store will distribute both, and an authority you must already hold a certificate from cannot be one the store hands out. Not the gateway's HTTPS material either, self-signed or ACME; that is a different trust domain with a different audience. The minting lives here rather than in swarm-bao.nix because it is an opinion about where the store's identity comes from -- the most consequential one available. The service serves what it is handed. A deployment with a real internal CA drops this file and names its own paths in serverCertFile / clientCaFile, and nothing in the store changes. Ordering simplifies too: with the unit and its consumer in one module, before/requiredBy is internal rather than a cross-module fact. Idempotent on ABSENCE only. Re-issuing the CA invalidates every client certificate already trusting it, so a rebuild that refreshed it would lock out every reader in the swarm at once.
43 lines
1.3 KiB
Nix
43 lines
1.3 KiB
Nix
# The full hyperhive host stack, pulled together in one place — this
|
|
# is what the flake exports as `nixosModules.default` (wrapped with
|
|
# the package/source wiring; see flake.nix). One import covers
|
|
# everything; `services.hyperhive.enable = true` turns the stack on.
|
|
#
|
|
# The forge is mandatory — hive-c0re mirrors every agent's applied
|
|
# config repo into it and it's the canonical store for the meta flake
|
|
# + `internal/*` repos, so there's no enable toggle; it deploys with
|
|
# hyperhive itself. hive-matrix is opt-in (off by default). All
|
|
# subsystems rely on `services.hyperhive.domain`, which is required
|
|
# (asserted in hive-network.nix) whenever hyperhive is enabled.
|
|
{
|
|
imports = [
|
|
./hyperhive.nix
|
|
./deploy.nix
|
|
./local-defaults.nix
|
|
./hive-c0re
|
|
./hive-ci.nix
|
|
./hive-forge
|
|
./hive-gateway
|
|
./hive-matrix.nix
|
|
./hive-network.nix
|
|
./hive-priv.nix
|
|
./hive-tls.nix
|
|
./otel.nix
|
|
./glue-bao-tls.nix
|
|
./swarm-authelia.nix
|
|
./swarm-bao.nix
|
|
./swarm-ca.nix
|
|
./swarm-nats.nix
|
|
./swarm-controller.nix
|
|
./swarm-grafana.nix
|
|
./swarm-otel.nix
|
|
./swarm-snapshot-store.nix
|
|
./swarm-ui.nix
|
|
./swarm-victorialogs.nix
|
|
./swarm-victoriametrics.nix
|
|
./swarm-wireguard.nix
|
|
./swarm.nix
|
|
./swarm-peers-removed.nix
|
|
./swarm-required-services.nix
|
|
];
|
|
}
|