06710e83b4
Cross-hive trust was O(n²) hand-pinning: every hive had to name every peer's CA. A swarm root makes it O(1) — trust the root once and every present and future peer validates. The root is generated by a new `swarm-ca` unit on a single-host swarm and operator-provided otherwise; `swarm.ca.autoConfigure` picks between them and derives its default from `swarm.peers` being empty, so "all on one host" is read off the deployment rather than remembered. Both modes produce the same artifacts in the same places, so splitting hosts later is moving the service dirs, not switching code paths. The root key never enters the nix store, and the root is never regenerated automatically — replacing it invalidates every peer at once. Each hive CA carries `nameConstraints` pinned to that hive's domain, so a leaked hive CA can only mint names inside its own subdomain, enforced by verifiers rather than by convention. `ca.pem` was serving as both the issuer and the anchor consumers trust; those are the same file only while it is self-signed. openssl will not terminate a chain at a trusted cert that isn't self-signed (rustls and Go will), so the promotion would have broken some consumers and not others. `hive-tls-ca` now also writes `trust-bundle.pem` — the hive CA plus whatever it is rooted at — and every anchor consumer reads that: agents, the CI and forge containers, and the peer-config recipe. On a hive with no swarm root the bundle is just that CA, so nothing consuming it needs a mode to branch on.
65 lines
2.9 KiB
Nix
65 lines
2.9 KiB
Nix
# Shared hive-CA trust plumbing for containers that must trust the
|
|
# self-signed gateway/forge leaf for *outbound* TLS (webhook delivery,
|
|
# CI artifact upload, …). The hive CA is generated at runtime by the host
|
|
# `hive-tls-ca.service` (see `hive-tls.nix`) — it can't be baked into a
|
|
# derivation — so each such container binds the public `ca.pem` read-only
|
|
# and orders its `container@<name>` unit after `hive-tls-ca.service` so the
|
|
# bind source exists before nspawn sets the mount up.
|
|
#
|
|
# This is the language-agnostic half (bind-mount + systemd ordering). The
|
|
# *consumption* differs per runtime and stays at each call site: Node's
|
|
# `NODE_EXTRA_CA_CERTS` is additive (hive-ci), Go's `SSL_CERT_FILE` replaces
|
|
# the bundle so it needs a system-CAs+hive-CA concat step (hive-forge).
|
|
#
|
|
# Pure function — NOT a NixOS module (don't add it to the host-modules
|
|
# aggregator). Call it from a module's `let`:
|
|
#
|
|
# caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
|
|
# # then, in the container:
|
|
# # bindMounts = { … } // caTrust.bindMount;
|
|
# # systemd.services."container@hive-ci" = lib.mkMerge [ caTrust.containerOrdering … ];
|
|
# # environment.NODE_EXTRA_CA_CERTS = caTrust.caContainerPath; # consumption, per-caller
|
|
#
|
|
# `tlsCfg` = config.services.hyperhive.tls
|
|
# `gatewayCfg` = config.services.hyperhive.gateway
|
|
{
|
|
lib,
|
|
tlsCfg,
|
|
gatewayCfg,
|
|
}:
|
|
let
|
|
# `gateway.useSelfSigned` is the single source of truth for the
|
|
# self-signed condition — no duplicated derivation.
|
|
useSelfSigned = gatewayCfg.useSelfSigned;
|
|
# The bundle, not `ca.pem`: the hive CA is an intermediate under the
|
|
# swarm root, and openssl (which is what both consumers below sit on —
|
|
# Node's `NODE_EXTRA_CA_CERTS`, Go's `SSL_CERT_FILE`) will not end a
|
|
# chain at a trusted cert that isn't self-signed. `hive-tls.nix` writes
|
|
# the bundle next to the CA and explains the split.
|
|
caHostPath = "${tlsCfg.stateDir}/trust-bundle.pem";
|
|
caContainerPath = "/run/hive-ca/trust-bundle.pem";
|
|
in
|
|
{
|
|
inherit useSelfSigned caContainerPath;
|
|
|
|
# Fold into the container's `bindMounts` via `//`. Binds ONLY the public
|
|
# CA cert (never the `hive-tls` state dir — it holds the CA + leaf private
|
|
# keys), read-only. Empty when not self-signed, so the whole trust path
|
|
# drops out cleanly.
|
|
bindMount = lib.optionalAttrs useSelfSigned {
|
|
${caContainerPath} = {
|
|
hostPath = caHostPath;
|
|
isReadOnly = true;
|
|
};
|
|
};
|
|
|
|
# Fold into the caller's `container@<name>` unit (via `lib.mkMerge` if the
|
|
# caller adds its own keys, e.g. hive-ci's `TimeoutStartSec`). Orders the
|
|
# container after the host `hive-tls-ca.service` so the bind source exists
|
|
# before nspawn sets the mount up — a condition-skipped/late CA would
|
|
# otherwise fail the container start.
|
|
containerOrdering = lib.mkIf useSelfSigned {
|
|
after = [ "hive-tls-ca.service" ];
|
|
requires = [ "hive-tls-ca.service" ];
|
|
};
|
|
}
|