mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

semi-spread example: serve internal vhosts on the VPN addresses only, over IPv4 and IPv6

Browse source
This commit is contained in:
atlas 2026-11-10 00:07:38 +01:00 • committed by mara
commit 7800f92425
1 changed files with 356 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

36
docs/examples/semi-spread/hive.nix
View file

@ -2,6 +2,9 @@
# hive `<name>`.
{ config, lib, ... }:
let
hyperhive = config.services.hyperhive;
name = lib.removePrefix "hive-" config.networking.hostName;
# The leaves for this hive, copied from swarm-central, where the secret store
# runs: `client.pem` and `client-key.pem` from
# `/var/lib/swarm-bao-pki/hives/<name>/`, along with that directory's
@ -10,19 +13,30 @@ let
pki = "/var/lib/swarm-pki";
in
{
services.hyperhive.deploy = {
hive-controller = {
enable = true;
hiveName = lib.removePrefix "hive-" config.networking.hostName;
};
bao = {
clientCertFile = "${pki}/client.pem";
clientKeyFile = "${pki}/client-key.pem";
services.hyperhive = {
deploy = {
hive-controller = {
enable = true;
hiveName = name;
};
bao = {
clientCertFile = "${pki}/client.pem";
clientKeyFile = "${pki}/client-key.pem";
};
};
# The hive's dashboard and its domain answer on the private addresses only.
gateway.vhosts =
lib.genAttrs
[
hyperhive.swarm.dashboardDomains.${name}
hyperhive.swarm.hives.${name}.domain
]
(_: {
public = false;
});
};
# The dashboard is reachable over the VPN only.
networking.firewall.interfaces.wg0.allowedTCPPorts = [
config.services.hyperhive.gateway.httpsPort
];
networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.gateway.httpsPort ];
}