93f1a76ea7
The secret store's pki root issues every hive's gateway leaf and the
swarm's service names, so the root swarm-ca.service generated on the
host anchors nothing and its key is a secret outside the store.
- swarm-ca.nix is gone: swarm-ca.service, root.pem and root-key.pem,
and the swarm.ca.{autoConfigure,stateDir,validityDays} options. A
definition of any of them fails evaluation with a removal message
(swarm-ca-removed.nix), and a tmpfiles rule deletes /var/lib/swarm-ca
on every host. singleHostSwarm no longer sets a swarm.* option.
- hive-tls-ca drops the $root slot: trust-bundle.pem holds the store's
pki root and a hive CA's public ca.pem/ca-previous.pem only.
- hivectl peer-config no longer prints the scp line for the swarm root;
the store's pki root is the one step.
- The gateway's cert import no longer stands a hive leaf or a throwaway
in for a missing swarm-services leaf where it Requires= the issuing
unit: it fails, naming swarm-services-cert.service. The stand-in stays
where the gateway does not wait (no swarm name, or the store's UI
only, whose passthrough must start with the store sealed).
Comments and docs that named swarm-ca.nix, swarm.ca.* or the host root
now name the store's pki root.
Refs #4588
67 lines
2.7 KiB
Nix
67 lines
2.7 KiB
Nix
# Migration shim for `services.hyperhive.swarm.peers`, replaced by the
|
||
# `swarm.hives` directory in ./swarm.nix.
|
||
#
|
||
# ⚠️ This is not a `mkRenamedOptionModule`. `hives` is not `peers`
|
||
# under another name, it is **`peers` ∪ {self}**: the set gains a member no
|
||
# existing config has ever written down, because a host's own identity
|
||
# lives in *other* options entirely. A rename migrates a name and a
|
||
# default can re-root a meaning; neither can conjure a new member.
|
||
#
|
||
# The whole module is self-contained and deletable — one file to remove
|
||
# when the deprecation window closes, with nothing else referring to it.
|
||
#
|
||
# Deliberately a warning rather than a hard failure, with the loudness
|
||
# coming from elsewhere: a config that set only `peers` leaves `hives`
|
||
# empty, so the self-entry assertion in ./swarm.nix fails the build
|
||
# anyway. The warning is what explains it; the assertion is what stops
|
||
# it.
|
||
{
|
||
lib,
|
||
config,
|
||
...
|
||
}:
|
||
let
|
||
peers = config.services.hyperhive.swarm.peers;
|
||
withCaCert = lib.attrNames (lib.filterAttrs (_: p: p ? caCert && p.caCert != null) peers);
|
||
in
|
||
{
|
||
options.services.hyperhive.swarm.peers = lib.mkOption {
|
||
type = lib.types.attrsOf lib.types.anything;
|
||
default = { };
|
||
visible = false;
|
||
internal = true;
|
||
description = ''
|
||
Removed — use `services.hyperhive.swarm.hives` instead, which
|
||
describes every hive in the swarm including this one. Kept only so
|
||
an existing definition produces a warning that says where to move
|
||
it, rather than an "option does not exist" error that says nothing.
|
||
'';
|
||
};
|
||
|
||
config.warnings =
|
||
lib.optional (peers != { }) ''
|
||
services.hyperhive.swarm.peers is removed and ignored. Move these
|
||
entries to services.hyperhive.swarm.hives, keyed by hive NAME
|
||
rather than domain, and add an entry for this hive itself
|
||
(services.hyperhive.hiveName) — `hives` is the swarm's full
|
||
directory, identical on every host.
|
||
|
||
services.hyperhive.swarm.hives.<name> = {
|
||
domain = "<the old attrset key>";
|
||
# wireguard* carries over unchanged
|
||
};
|
||
|
||
Still set: ${lib.concatStringsSep ", " (lib.attrNames peers)}
|
||
''
|
||
++ lib.optional (withCaCert != [ ]) ''
|
||
services.hyperhive.swarm.peers.<hive>.caCert is removed and
|
||
ignored, and has no replacement in services.hyperhive.swarm.hives.
|
||
|
||
Trust inside a swarm derives from the secret store's pki root (see
|
||
docs/swarm/ca.md): every hive chains to it, so a per-hive CA is dead
|
||
weight. What this genuinely drops is trusting a hive whose root this
|
||
swarm does NOT own — another swarm's, or one keeping its own CA.
|
||
|
||
Still set on: ${lib.concatStringsSep ", " withCaCert}
|
||
'';
|
||
}
|