c10cc0e018
`swarm-bao-nats-callout-xkey` runs `ensure-callout-keys`, importing
/var/lib/swarm-nats-callout/{issuer,callout-user}.seed when present so the
keys keep their public halves, then fetches all three public halves from
the store. The verb removes each seed file once a read of the store returns
a seed; when the store's seed differs, it is kept and a warning names the
file. No tmpfiles rule touches those files, since one could run before the
import with the store sealed and leave the next run to mint a new key.
The server renders the issuer and user public halves from the fetched files,
checked for shape as the xkey's is, and does not start without them. The
responder reads both seeds from the store, so the copies into the container
and their LoadCredential entries are gone, and a tmpfiles rule removes the
copies a container still holds. `swarm-nats-callout-keys` is removed.
On the store's host the fetch unit is also ordered after
`swarm-bao-secret-publisher-policy`, so the publisher's denial of the seed
paths is written before the unit creates or keeps a seed there.
`deploy.nats.autoGenerateCallout`, `calloutUserPublicKey`,
`calloutIssuerPublicKey`, `calloutUserSeedFile` and `calloutIssuerSeedFile`
are removed with `mkRemovedOptionModule`, under `swarm.nats` too, each
message saying the keys live in the store.
52 lines
2.1 KiB
Nix
52 lines
2.1 KiB
Nix
# Removal shim for the queue's callout nkey options, and for the copies of
|
|
# their seeds inside the `swarm-nats` container.
|
|
#
|
|
# The callout issuer and user keys live in the swarm secret store beside the
|
|
# callout xkey: `swarm-bao-nats-callout-xkey` in ./swarm-nats.nix creates
|
|
# them there, and the server renders their public halves from the store. A
|
|
# definition of a removed option fails evaluation with a message, under its
|
|
# `deploy.nats` path and under the `swarm.nats` one older configs use.
|
|
#
|
|
# The host seed files under /var/lib/swarm-nats-callout are NOT removed here:
|
|
# that unit stores each one before it removes it, and a tmpfiles rule could
|
|
# run first.
|
|
#
|
|
# Self-contained and deletable, like ./host-ca-removed.nix: one file to
|
|
# remove when the deprecation window closes.
|
|
{ lib, ... }:
|
|
let
|
|
inStore = ''
|
|
The queue's callout issuer and user keys live in the swarm secret store:
|
|
swarm-bao-nats-callout-xkey creates them there, and the server renders
|
|
their public halves from it. Remove this definition. See
|
|
docs/swarm/secrets.md.
|
|
'';
|
|
# The seed-file options name a key an operator may want to keep.
|
|
seedFile = name: ''
|
|
${inStore}
|
|
A seed at /var/lib/swarm-nats-callout/${name} is what that unit stores
|
|
when the store holds none, so a key placed there keeps its public half;
|
|
otherwise a new key is created.
|
|
'';
|
|
removed = name: message: [
|
|
(lib.mkRemovedOptionModule [ "services" "hyperhive" "deploy" "nats" name ] message)
|
|
(lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "nats" name ] message)
|
|
];
|
|
|
|
containerSeedDir = "/var/lib/nixos-containers/swarm-nats/var/lib/swarm-nats-auth";
|
|
in
|
|
{
|
|
imports = lib.concatLists [
|
|
(removed "autoGenerateCallout" inStore)
|
|
(removed "calloutUserPublicKey" inStore)
|
|
(removed "calloutIssuerPublicKey" inStore)
|
|
(removed "calloutUserSeedFile" (seedFile "callout-user.seed"))
|
|
(removed "calloutIssuerSeedFile" (seedFile "issuer.seed"))
|
|
];
|
|
|
|
# The responder reads both seeds from the store and names neither file.
|
|
systemd.tmpfiles.rules = map (f: "r ${containerSeedDir}/${f}") [
|
|
"callout-user.seed"
|
|
"issuer.seed"
|
|
];
|
|
}
|