eaa52ef200
A hive that does not host authelia has no path to its own agent queue client secret. The mint writes the plaintext to a host directory whose other reader lives in a different container, so the host that mints is the only place both trees are addressable — which is where this unit runs. Four pieces, in the order they depend on each other: the leaf (glue-bao-tls.nix signs it, because the thing that owns a private key owns issuing from it), the module declaring its own cert/key options, the one-pairing glue file pointing them at that leaf, and the imports. The unit is gated on holding a client identity, never on deploy.bao.enable — that option is the co-location assumption itself, and the publisher is the case that assumption excludes. The secret is passed to bao as `value=@<path>`, never as an argv element: bao is an external binary, so an argument is world-readable in /proc for the life of the call. Refs #3853
42 lines
1.7 KiB
Nix
42 lines
1.7 KiB
Nix
# Glue: point the secret publisher at the bao leaf minted for it.
|
|
#
|
|
# ONE PAIRING PER FILE — publisher ← bao, and nothing else. Deleting this
|
|
# leaves a publisher that takes operator-provided certificate paths, which is
|
|
# what any deployment not minting its own already does.
|
|
#
|
|
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
|
|
# leaf, because the thing that owns a private key owns issuing from it. What
|
|
# belongs here is the pairing: which paths this host's publisher reads.
|
|
#
|
|
# ⚠️ Gated on the leaf existing, not on the store being enabled — the same rule
|
|
# ./glue-controller-bao-identity.nix states. A publisher on the store's own
|
|
# host is one deployment; a publisher beside a remote authelia holding a leaf
|
|
# issued out of band is another, and both want this wiring.
|
|
#
|
|
# Everything is `mkDefault`. An operator naming their own paths wins.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
baoDeploy = deployCfg.bao;
|
|
|
|
# Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own
|
|
# path rather than repeating that file's directory literal: an operator who
|
|
# moves the PKI moves both, and the two cannot drift apart.
|
|
haveMintedPki = baoDeploy.clientCertFile != null;
|
|
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
|
|
in
|
|
{
|
|
config =
|
|
lib.mkIf (hyperhiveCfg.enable && deployCfg.swarm-secret-publisher.enable && haveMintedPki)
|
|
{
|
|
services.hyperhive.deploy.swarm-secret-publisher = {
|
|
baoClientCertFile = lib.mkDefault "${pkiDir}/secret-publisher.pem";
|
|
baoClientKeyFile = lib.mkDefault "${pkiDir}/secret-publisher-key.pem";
|
|
};
|
|
};
|
|
}
|