mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nats and bao can listen on a routable address, opt-in

Browse source
This commit is contained in:
atlas 2026-11-09 17:32:03 +01:00 • committed by mara
commit 892675628d
1 changed files with 174 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/module-eval/nats-tls.nix
View file

@ -42,6 +42,7 @@ let
# The queue on a host whose store is elsewhere: no local policy unit.
queueNoStore = hive {
deploy.nats.enable = true;
deploy.nats.openFirewall = true;
};
inherit (shared) natsOnStoreHostReaderMoved;
@ -256,6 +257,12 @@ let
name = "the server requires TLS: no allow_non_tls";
ok = !(natsContainer.services.nats.settings ? allow_non_tls);
}
{
# Reachability is the firewall alone because no listen address is set.
name = "the server sets no listen address, so it binds every address";
ok =
!(natsContainer.services.nats.settings ? host) && !(natsContainer.services.nats.settings ? listen);
}
{
name = "4222 is open on wg-hive when this host is on the mesh, and never host-wide";
ok =
@ -263,6 +270,19 @@ let
&& !(lib.elem 4222 allLocalMesh.networking.firewall.allowedTCPPorts)
&& lib.elem 4222 (bridgePorts allLocalMesh);
}
{
# Off is today's config; the bridge arm is the control that the lookup
# finds a port that is there. On adds the host-wide port and keeps the
# bridge one.
name = "4222 is open host-wide only with openFirewall, and the bridge keeps it either way";
ok =
queueNoStore.services.hyperhive.deploy.nats.openFirewall
&& lib.elem 4222 queueNoStore.networking.firewall.allowedTCPPorts
&& lib.elem 4222 (bridgePorts queueNoStore)
&& !allLocal.services.hyperhive.deploy.nats.openFirewall
&& !(lib.elem 4222 allLocal.networking.firewall.allowedTCPPorts)
&& lib.elem 4222 (bridgePorts allLocal);
}
{
name = "4222 is not opened on wg-hive when this host is not on the mesh";
ok =