mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: move the egress firewall options under deploy.hive-controller.egress

Browse source
This commit is contained in:
damocles 2026-11-14 18:38:47 +01:00 • committed by mara
commit 7468aa4cff
1 changed files with 148 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

96
nix/host-modules/deploy.nix
View file

@ -305,6 +305,102 @@ in
[ "services" "hyperhive" "deploy" "hive-controller" "adminUsers" ]
)
# The host's egress firewall settings sit with the controller's, like the
# egress proxy's below. The two read-only outputs, `leaseScript` and
# `ruleset`, stay under `network.egress`.
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "network" "egress" "forward" ]
[ "services" "hyperhive" "deploy" "hive-controller" "egress" "forward" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "network" "egress" "antiSpoof" ]
[ "services" "hyperhive" "deploy" "hive-controller" "egress" "antiSpoof" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "network" "egress" "intercept" "enable" ]
[
"services"
"hyperhive"
"deploy"
"hive-controller"
"egress"
"intercept"
"enable"
]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "network" "egress" "intercept" "httpPort" ]
[
"services"
"hyperhive"
"deploy"
"hive-controller"
"egress"
"intercept"
"httpPort"
]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "network" "egress" "intercept" "httpsPort" ]
[
"services"
"hyperhive"
"deploy"
"hive-controller"
"egress"
"intercept"
"httpsPort"
]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "network" "egress" "intercept" "relayPort" ]
[
"services"
"hyperhive"
"deploy"
"hive-controller"
"egress"
"intercept"
"relayPort"
]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "network" "egress" "intercept" "refuseEch" ]
[
"services"
"hyperhive"
"deploy"
"hive-controller"
"egress"
"intercept"
"refuseEch"
]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "network" "egress" "intercept" "agentAllowFile" ]
[
"services"
"hyperhive"
"deploy"
"hive-controller"
"egress"
"intercept"
"agentAllowFile"
]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "network" "egress" "intercept" "unrestrictedFile" ]
[
"services"
"hyperhive"
"deploy"
"hive-controller"
"egress"
"intercept"
"unrestrictedFile"
]
)
# The egress proxy runs only on a hive host, so its settings sit with the
# controller's. The read-only ones moved without a forward.
(lib.mkRenamedOptionModule