mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the swarm wireguard mesh; tombstone its options

Browse source
This commit is contained in:
atlas 2026-11-15 02:17:44 +01:00
commit adc61c9043
2 changed files with 330 additions and 1068 deletions
Download patch file Download diff file Expand all files Collapse all files

68
nix/module-eval/core-toggle.nix
View file

@ -1615,12 +1615,11 @@ let
&& lib.hasInfix ''iifname "hive-br0" oifname != "hive-br0" ct state new update @log_v4 { ip saddr limit rate'' chain
&& lib.hasInfix ''iifname "hive-br0" oifname != "hive-br0" ct state new update @log_v6 { ip6 saddr limit rate'' chain
&& lib.hasInfix ''log prefix "hive-egress-would-drop "'' chain
&& lib.hasInfix ''iifname "hive-br0" oifname "wg-hive" accept'' chain
# The mesh comes first, then the exempt MACs (service containers and
# unrestricted agents), then the counter and the logging: a flow of an
# exempt MAC is neither counted nor logged.
# The exempt MACs (service containers and unrestricted agents) come
# first, then the counter and the logging: a flow of an exempt MAC is
# neither counted nor logged. No interface is exempt by name.
&& lib.hasInfix ''iifname "hive-br0" oifname != "hive-br0" ether saddr @direct_mac accept'' chain
&& idx ''oifname "wg-hive" accept'' < idx "ether saddr @direct_mac accept"
&& !(lib.hasInfix "wg-hive" text)
&& idx "ether saddr @direct_mac accept" < idx "counter"
&& idx "counter" < idx "update @log_v4"
# The per-source rules accept after logging, and the unmetered rule
@ -1749,11 +1748,11 @@ let
{
# `reject` logs and refuses in one rule, as a TCP rule (reset) and a
# non-TCP rule (ICMP admin-prohibited) for each of the four log/verdict
# positions, after the mesh and the exempt MACs. The ruleset is read as
# text. The `accept` count (the mesh and the exempt MACs only) and the
# positions, after the exempt MACs. The ruleset is read as
# text. The `accept` count (the exempt MACs only) and the
# `bare` host, whose chain has no refusal, are the controls that the
# lookups find what is there.
name = "egress.forward reject refuses the bridge's forwarded flows after the mesh and the exempt MACs";
name = "egress.forward reject refuses the bridge's forwarded flows after the exempt MACs";
ok =
let
text = lib.head (
@ -1772,10 +1771,10 @@ let
) egressForwardReject.assertions)
&& lib.hasInfix "type filter hook forward priority filter - 10; policy accept;" chain
&& lib.hasInfix "chain input" text
&& idx ''oifname "wg-hive" accept'' < idx "ether saddr @direct_mac accept"
&& !(lib.hasInfix "wg-hive" text)
&& idx "ether saddr @direct_mac accept" < idx "counter"
&& idx "counter" < idx "reject"
&& lib.length (lib.filter (lib.hasSuffix " accept") rules) == 2
&& lib.length (lib.filter (lib.hasSuffix " accept") rules) == 1
&& lib.length tcp == 4
&& lib.length other == 4
&& lib.all (lib.hasSuffix " reject with tcp reset") tcp
@ -1818,7 +1817,7 @@ let
# The redirect of the agents' web traffic: IPv4 TCP 80 and 443 from the
# bridge go to squid's two intercept ports, after the rules that leave
# alone the exempt MACs (service containers, unrestricted agents), the
# host's own addresses, the bridge and the mesh. The chain is read as the
# host's own addresses and the bridge. The chain is read as the
# lines between its header and the log sets that follow it. The host
# without a controller (`egressForwardAccept`) has the set but no chain.
name = "the egress table redirects the bridge's web traffic into squid after its exemptions";
@ -1845,7 +1844,7 @@ let
&& lib.hasInfix ''oifname != "hive-br0" ether saddr @direct_mac accept'' inet
&& !(lib.hasInfix "ether saddr @direct_mac accept" without)
&& idx "fib daddr type local return" < idx "tcp dport 80"
&& idx ''fib daddr oifname { "hive-br0", "wg-hive" } return'' < idx "tcp dport 80"
&& idx ''fib daddr oifname "hive-br0" return'' < idx "tcp dport 80"
&& lib.length redirects == 2
&& lib.hasInfix "tcp dport 80 counter redirect to :3129" (lib.head redirects)
# Port 443 goes to the ClientHello relay, not to squid.
@ -2578,6 +2577,51 @@ let
in
lib.all (path: refused old path) paths && !(lib.any (path: refused bare path) paths);
}
{
# One host defining every removed mesh option, the five deploy paths and
# the three per-hive fields of one directory entry. Each message names
# its own path, so each lookup finds only its option. The control is a
# host that defines none: it has to pass the same assertions, which also
# shows the lookups find a failing assertion when there is one.
name = "a definition of a removed WireGuard mesh option fails evaluation, naming the option and the issue";
ok =
let
deployPaths = map (o: "services.hyperhive.deploy.wireguard.${o}") [
"enable"
"privateKeyFile"
"address"
"listenPort"
"persistentKeepalive"
];
hiveFields = map (f: "peer.${f}") [
"wireguardPublicKey"
"wireguardEndpoint"
"wireguardAddress"
];
failed = m: lib.filter (a: !a.assertion) m.assertions;
names =
m: path:
lib.any (a: lib.hasInfix path a.message && lib.hasInfix "WireGuard mesh was removed" a.message) (
failed m
);
old = hive {
deploy.wireguard = {
enable = true;
privateKeyFile = "/etc/wireguard/hive.key";
address = "10.100.0.1/24";
listenPort = 51820;
persistentKeepalive = 25;
};
swarm.hives.peer = {
wireguardPublicKey = "key";
wireguardEndpoint = "203.0.113.1:51820";
wireguardAddress = "10.100.0.2/32";
};
};
in
lib.all (path: names old path) (deployPaths ++ hiveFields)
&& !(lib.any (path: names bare path) (deployPaths ++ hiveFields));
}
{
# Refused wherever any hyperhive service runs, the hive or a swarm
# service alone. The host enabling nothing is the control that it is

22
nix/module-eval/nats-tls.nix
View file

@ -32,13 +32,6 @@ let
# are all here, so the scan below reads each of them.
inherit (shared) allLocal;
# The same host on the mesh.
allLocalMesh = hive {
deploy.singleHostSwarm = true;
deploy.wireguard.enable = true;
deploy.wireguard.address = "10.100.0.1/24";
};
# The queue on a host whose store is elsewhere: no local policy unit.
queueNoStore = hive {
deploy.nats.enable = true;
@ -275,13 +268,6 @@ let
ok =
!(natsContainer.services.nats.settings ? host) && !(natsContainer.services.nats.settings ? listen);
}
{
name = "4222 is open on wg-hive when this host is on the mesh, and never host-wide";
ok =
lib.elem 4222 allLocalMesh.networking.firewall.interfaces.wg-hive.allowedTCPPorts
&& !(lib.elem 4222 allLocalMesh.networking.firewall.allowedTCPPorts)
&& lib.elem 4222 (bridgePorts allLocalMesh);
}
{
# Off is today's config; the bridge arm is the control that the lookup
# finds a port that is there. On adds the host-wide port and keeps the
@ -295,14 +281,6 @@ let
&& !(lib.elem 4222 allLocal.networking.firewall.allowedTCPPorts)
&& lib.elem 4222 (bridgePorts allLocal);
}
{
name = "4222 is not opened on wg-hive when this host is not on the mesh";
ok =
!(lib.elem 4222
(allLocal.networking.firewall.interfaces.wg-hive or { allowedTCPPorts = [ ]; }).allowedTCPPorts
)
&& !(lib.elem 4222 allLocal.networking.firewall.allowedTCPPorts);
}
{
# Ordering, never a requirement: a policy unit that failed still counts
# as done, and the leaf unit's own retries carry it past that.