3c79c5eb5d
glue-nats-auth-bao-identity.nix defaulted deploy.nats.authBaoClient{Cert,Key}File
to a sibling of deploy.bao.clientCertFile, which is the hive's own store
reader. That tied a swarm service to a hive identity, pointed a store host
whose reader was moved at a file nobody mints, and on a queue host without
the store that held only a placed hive reader invented a nats-auth.pem path
that passed the eval assertion and failed at runtime.
The glue is now gated on the store running on this host (deploy.bao.enable,
the condition glue-bao-tls.nix mints under) and names the directory the
minting unit writes to, shared through nix/host-modules/lib/bao-pki-dir.nix.
A queue host without the store gets no default and the eval assertion
refuses it until the responder's own leaf is named; the assertion message
now names deploy.bao.enable as where the default comes from.
On a default store host the evaluated paths are unchanged:
/var/lib/swarm-bao-pki/nats-auth{,-key}.pem.
Refs #4921
5 lines
267 B
Nix
5 lines
267 B
Nix
# Where ./glue-bao-tls.nix keeps the store's own CA and the leaves it signs,
|
|
# on the host that runs the store. Shared so a glue that points a principal at
|
|
# its minted leaf names the directory the minting unit writes to, not a copy
|
|
# of it.
|
|
"/var/lib/swarm-bao-pki"
|