5761398d60
swarm-services-cert issues the swarm-services leaf a self-signed gateway
serves, and on a host fronting no swarm name fetches the store's pki root.
It is gated on the gateway, not on a hive, yet its leaf pair was named
under deploy.hive-controller.tls and defaulted from the hive reader's cert
directory, and the root fetch presented the hive's own identity. A gateway
host with no hive had no such identity, so that branch was red by
construction.
- The pair moves to deploy.bao.servicesIssuerClient{Cert,Key}File, beside
the store's other host-unit readers, and glue-bao-tls.nix defaults it on
the store's host from the leaf it already mints. The old
deploy.hive-controller.tls.baoClient{Cert,Key}File paths are
mkRenamedOptionModule aliases. glue-services-issuer-bao-identity.nix,
which derived the default from deploy.bao.clientCertFile, is gone.
- The no-swarm-name root fetch presents the services-issuer pair. The hive
identity is now only hive-tls-resign's.
- A self-signed gateway with no pair fails evaluation, naming both options.
A pair named but unreadable still fails the unit, naming the paths.
Refs #4921
35 lines
1.3 KiB
Nix
35 lines
1.3 KiB
Nix
# Glue: point the gateway-leaf issuance at the hive's own bao identity minted
|
|
# for it.
|
|
#
|
|
# ONE PAIRING PER FILE — the hive's gateway-leaf principal ← bao, and nothing
|
|
# else. Deleting this leaves a hive that takes an operator-provided path to
|
|
# that credential, which is what every hive on a host without the store does.
|
|
#
|
|
# ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
|
|
# leaf, because the thing that owns a private key owns issuing from it.
|
|
#
|
|
# Gated on the minted PKI existing, as that file is, and on a hive running
|
|
# here: a host without one has no hive leaf to ask for.
|
|
#
|
|
# Everything is `mkDefault`. An operator naming their own paths wins.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
baoDeploy = config.services.hyperhive.deploy.bao;
|
|
|
|
# Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own
|
|
# path rather than repeating that file's directory literal.
|
|
haveMintedPki = baoDeploy.clientCertFile != null;
|
|
pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
|
|
in
|
|
{
|
|
config = lib.mkIf (haveMintedPki && config.services.hyperhive.deploy.hive-controller.enable) {
|
|
services.hyperhive.deploy.hive-controller.tls = {
|
|
baoHiveIdentityCertFile = lib.mkDefault "${pkiDir}/hive-leaf.pem";
|
|
baoHiveIdentityKeyFile = lib.mkDefault "${pkiDir}/hive-leaf-key.pem";
|
|
};
|
|
};
|
|
}
|