remove the swarm wireguard mesh; tombstone its options
This commit is contained in:
atlas
parent
fbfc6f392a
commit
adc61c9043
3 changed files with 330 additions and 1068 deletions
|
|
@ -126,9 +126,8 @@ if you want it. What that grant lets an agent reach on a hive is on the
|
|||
|
||||
Each hive carries an identity (`hiveName`, the `swarm.hives` directory) that
|
||||
says which hive it's and how to reach the others; the directory feeds the
|
||||
swarm UI's hive list, matrix federation and the optional WireGuard mesh. →
|
||||
[the hive directory](hive-directory.md). A private link between hives instead
|
||||
of public HTTPS: [WireGuard mesh](wireguard.md).
|
||||
swarm UI's hive list and matrix federation. →
|
||||
[the hive directory](hive-directory.md).
|
||||
|
||||
## Cross-references
|
||||
|
||||
|
|
|
|||
|
|
@ -95,18 +95,14 @@ mechanism.
|
|||
swarm's root needs a CA-issued certificate (ACME). Federation firewall
|
||||
and TLS requirements: [`2-handbook/swarm/matrix.md`](matrix.md).
|
||||
|
||||
3. **WireGuard mesh** (optional) — `deploy.wireguard.enable` reads each
|
||||
entry's `wireguardPublicKey`/`wireguardEndpoint`/`wireguardAddress`
|
||||
to configure `wg-hive`. See [the WireGuard page](wireguard.md).
|
||||
|
||||
## Reaching the queue and the store on a routable address
|
||||
|
||||
The mesh isn't the only way to reach the queue and the secret store from
|
||||
another host. Set `deploy.nats.openFirewall` on the queue's host to open the
|
||||
queue's port on every interface, and `deploy.bao.openFirewall` together with
|
||||
Other hives reach the queue and the secret store on a routable address. Set
|
||||
`deploy.nats.openFirewall` on the queue's host to open the queue's port on
|
||||
every interface, and `deploy.bao.openFirewall` together with
|
||||
`deploy.bao.extraListenAddresses` on the store's host to open the store's port
|
||||
on the addresses it listens on. Both default to off. Each exposes a service
|
||||
beyond the tunnel, which is the operator's decision. The queue requires TLS and
|
||||
beyond the agent bridge, which is the operator's decision. The queue requires TLS and
|
||||
its `auth_callout` refuses every client it can't identify. The store requires a
|
||||
client certificate on every listener, and evaluation fails when you
|
||||
set `deploy.bao.openFirewall` without `deploy.bao.clientCaFile`. Point
|
||||
|
|
|
|||
|
|
@ -1,80 +0,0 @@
|
|||
# WireGuard mesh between hives (optional)
|
||||
|
||||
The peer config in [the hive directory](hive-directory.md#hive-identity-config) uses public HTTPS for all inter-hive traffic.
|
||||
For private deployments — or to reduce latency and TLS overhead on
|
||||
intra-swarm traffic — hyperhive can configure a host-to-host
|
||||
WireGuard mesh.
|
||||
|
||||
## Generating keys
|
||||
|
||||
On each hive host:
|
||||
|
||||
```bash
|
||||
wg genkey | install -m 0400 /dev/stdin /etc/wireguard/hive.key
|
||||
wg pubkey < /etc/wireguard/hive.key # → share this with peer operators
|
||||
```
|
||||
|
||||
## Config example (two hives)
|
||||
|
||||
```nix
|
||||
# hive A (firsthive.myswarm.example, mesh IP 10.100.0.1)
|
||||
services.hyperhive = {
|
||||
deploy.wireguard = {
|
||||
enable = true;
|
||||
privateKeyFile = "/etc/wireguard/hive.key";
|
||||
address = "10.100.0.1/24";
|
||||
listenPort = 51820; # optional, default 51820
|
||||
};
|
||||
|
||||
# The same `hives` attrset both hosts hold — mesh fields included,
|
||||
# since "where this hive can be dialled" is a fact about that hive.
|
||||
swarm.hives = {
|
||||
firsthive = {
|
||||
domain = "firsthive.myswarm.example";
|
||||
wireguardPublicKey = "base64keyA=";
|
||||
wireguardEndpoint = "198.51.100.1:51820";
|
||||
wireguardAddress = "10.100.0.1/32";
|
||||
};
|
||||
secondhive = {
|
||||
domain = "secondhive.elsewhere.example";
|
||||
wireguardPublicKey = "base64keyB=";
|
||||
wireguardEndpoint = "203.0.113.42:51820";
|
||||
wireguardAddress = "10.100.0.2/32";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# hive B (secondhive.elsewhere.example, mesh IP 10.100.0.2)
|
||||
services.hyperhive = {
|
||||
deploy.wireguard = {
|
||||
enable = true;
|
||||
privateKeyFile = "/etc/wireguard/hive.key";
|
||||
address = "10.100.0.2/24";
|
||||
};
|
||||
|
||||
swarm.hives = {
|
||||
# … identical to hive A's …
|
||||
};
|
||||
};
|
||||
```
|
||||
|
||||
## What the mesh does
|
||||
|
||||
- hyperhive configures `networking.wireguard.interfaces.wg-hive` on the
|
||||
host (not inside agent containers; containers reach peers via the
|
||||
host's routing table).
|
||||
- It opens UDP port 51820 (or `listenPort`) on the host firewall.
|
||||
- It reads each entry's `wireguardAddress` from `services.hyperhive.swarm.hives`,
|
||||
minus this host's own hive, to build `wg-hive`'s `allowedIPs`, so intra-swarm
|
||||
traffic can route over the mesh address rather than the public domain.
|
||||
- It sets `persistentKeepalive = 25` by default; override or null to
|
||||
disable (not needed when both sides have public IPs and no NAT).
|
||||
|
||||
## NAT / one-sided endpoints
|
||||
|
||||
If one host is behind NAT and can't accept incoming connections, only
|
||||
that host needs a null `wireguardEndpoint` on the peer config — the
|
||||
other side initiates. With keepalive on, the NAT hole stays open.
|
||||
|
||||
If both hosts are behind NAT, you need a STUN relay or a third host
|
||||
(exit node); hyperhive sets up neither.
|
||||
Loading…
Reference in a new issue