c18aee8f74
glue-bao-tls.nix signs a third leaf. It is minted whether or not a controller runs here, because the case it serves is the one where it does not: a controller elsewhere needs a leaf from this CA and cannot sign one, so issuing it here turns "obtain a certificate out of band" into "copy this file". glue-controller-bao-identity.nix holds the pairing and nothing else -- which paths this host's controller reads. Gated on the leaf existing rather than on deploy.bao.enable, so a controller on the store's host and one three networks away with an out-of-band leaf get the same wiring; gating on the store would have made the co-located case the only supported shape. The directory comes from deploy.bao.clientCertFile rather than repeating glue-bao-tls.nix's literal, so moving the PKI moves both. module-eval gains three cases and two fixtures, because nothing asserted the PKI script before: an earlier commit added a leaf to that rendered unit and left the derivation unchanged. The fixture's CN is deliberately a value no default could supply, so "the role and the leaf both carry it" says they read one option rather than that both happen to say swarm-controller. Gates: 62 module properties hold (59 before, plus these three), on a derivation hash that actually moved -- this suite is a cache hit when only fixtures change, so an unchanged hash would have meant the cases never ran. nix fmt clean, all three scripts/check-*.sh exit 0.
41 lines
1.8 KiB
Nix
41 lines
1.8 KiB
Nix
# Glue: point the swarm controller at the bao leaf minted for it.
|
|
#
|
|
# ONE PAIRING PER FILE — controller ← bao, and nothing else. Deleting this
|
|
# leaves a controller that takes operator-provided certificate paths, which is
|
|
# what every deployment that does not mint its own already does.
|
|
#
|
|
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
|
|
# leaf, because the thing that owns a private key owns issuing from it; a
|
|
# second signer would duplicate that file's `openssl` helper to no benefit.
|
|
# What belongs here is the pairing: which paths this host's controller reads.
|
|
#
|
|
# ⚠️ Gated on the leaf existing, not on the store being enabled. A controller
|
|
# on the store's own host is one deployment; a controller three networks away
|
|
# holding a leaf issued out of band is another, and both want the same wiring.
|
|
# `deploy.bao.enable` would have made the first one the only supported shape.
|
|
#
|
|
# Everything is `mkDefault`. An operator naming their own paths wins.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
hyperhiveCfg = config.services.hyperhive;
|
|
deployCfg = hyperhiveCfg.deploy;
|
|
baoDeploy = deployCfg.bao;
|
|
|
|
# Where ./glue-bao-tls.nix puts the leaves. Derived from the reader's own
|
|
# path rather than repeating that file's directory literal: an operator who
|
|
# moves the PKI moves both, and the two cannot drift apart.
|
|
haveMintedPki = baoDeploy.clientCertFile != null;
|
|
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
|
|
in
|
|
{
|
|
config = lib.mkIf (hyperhiveCfg.enable && deployCfg.swarm-controller.enable && haveMintedPki) {
|
|
services.hyperhive.deploy.swarm-controller = {
|
|
baoClientCertFile = lib.mkDefault "${pkiDir}/controller.pem";
|
|
baoClientKeyFile = lib.mkDefault "${pkiDir}/controller-key.pem";
|
|
};
|
|
};
|
|
}
|