mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-matrix: prefill the chat client with the server name, not the hive domain

Browse source
This commit is contained in:
damocles 2026-11-10 21:45:49 +01:00 • committed by mara
commit 1cc1cb804d
3 changed files with 21 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/2-handbook/swarm/matrix.md
View file

@ -104,6 +104,12 @@ at the server name, which names `<gatewayHost>:443`
([`gateway.md::Discovery flow`](../../4-implementation/networking/gateway.md#discovery-flow-matrix)).
Port 8448 isn't used.
The web chat client at `chat.<swarm-domain>` signs in the same way: its
login dialog preselects the server name and looks the homeserver up through
that discovery answer. That's the swarm domain by default, and the hive
domain on a homeserver that pinned `serverName` to it. Typing the server name
into any other Matrix client uses the same value.
Outbound, the container sits on the hive bridge like the CI runner: it
leases an address from the gateway's DHCP, resolves through its dnsmasq,
and leaves through the bridge's NAT. It reaches the secret store,

13
nix/host-modules/hive-matrix.nix
View file

@ -9,10 +9,6 @@ let
networkCfg = config.services.hyperhive.network;
tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
gatewayCfg = config.services.hyperhive.gateway;
# The hive's own domain; null on a homeserver host that runs no hive, where
# the client is pointed at the server name instead.
hyperhiveDomain = config.services.hyperhive.domain;
rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
# Same runtime→build-time bridge hive-forge and swarm-ci-runner cross:
@ -554,14 +550,13 @@ in
};
# FluffyChat boot-config pre-fill so the client's
# `.well-known/matrix/client` lookup hits the right delegation
# endpoint. A hive host names its hive domain; a homeserver host
# without a hive has none and names the server name.
# endpoint. That lookup reads the server name, which the swarm apex
# (or the hive vhost a pinned server name equals) answers for, not
# the hive domain.
"= /config.json" = {
extraConfig = ''
default_type application/json;
return 200 '{"defaultHomeserver":"${
if hyperhiveDomain != null then hyperhiveDomain else effectiveServerName
}"}';
return 200 '{"defaultHomeserver":"${effectiveServerName}"}';
'';
};
};

11
nix/module-eval/matrix-core.nix
View file

@ -63,6 +63,17 @@ let
in
lib.hasInfix "client_max_body_size 100048576;" c && !(lib.hasInfix "client_max_body_size 50M" c);
}
{
# The chat client signs in against the server name, which for a default
# swarm is the swarm domain; the hive domain (`h1.t.local`) is a vhost
# that answers no discovery there, so a prefill of it is a dead end.
name = "the chat client's homeserver prefill is the server name, not the hive domain";
ok =
let
c = matrixBodyCap.services.nginx.virtualHosts."chat.t.local".locations."= /config.json".extraConfig;
in
lib.hasInfix ''{"defaultHomeserver":"t.local"}'' c && !(lib.hasInfix "h1.t.local" c);
}
{
# Absence arm. A hive with no client identity gets no
# store environment at all — the daemon reports a queue it cannot serve