mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: per-vhost public flag, private listen addresses, and IPv6 listeners

Browse source
This commit is contained in:
atlas 2026-11-09 21:38:36 +01:00
commit fbbdf26a19
1 changed files with 364 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

76
nix/host-modules/hive-gateway/options.nix
View file

@ -145,6 +145,16 @@ in
request with a response, such as the catch-all.
'';
};
options.public = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Whether this vhost answers on every address the gateway listens
on. `false` binds it to `privateListenAddresses` only, so the
public address never serves it (see that option). Needs a
non-empty `privateListenAddresses`.
'';
};
options.certificate = lib.mkOption {
type = lib.types.nullOr (
lib.types.submodule {
@ -177,7 +187,9 @@ in
config — and the gateway renders it into
`services.nginx.virtualHosts.<name>` with the parts it owns:
- `listen`, the gateway's port pair;
- `listen`, the gateway's port pair on its addresses
(`gateway.lib.listen`, or `gateway.lib.privateListen` for a vhost
that sets `public = false`);
- the TLS attributes for that name (`gateway.lib.tlsFor`, or
`certificate` below), with `addSSL` dropped when the vhost sets
`forceSSL`;
@ -203,12 +215,23 @@ in
internal = true;
readOnly = true;
description = ''
Read-only: the `listen` set every vhost in front of this
gateway shares (plain http on `port`, TLS on `httpsPort`).
Applied to every vhost declared under `vhosts`, and read by
the gateway's own vhosts, so no vhost binds a different
set — one that did would be reachable on a port the gateway
does not consider its own.
Read-only: the `listen` set of a vhost that answers on every
address (plain http on `port`, TLS on `httpsPort`; on `0.0.0.0`,
on `[::]` when `listenIPv6` is set, and on each of
`privateListenAddresses`). Applied to every vhost declared under
`vhosts` that keeps `public = true`, and read by the gateway's own
vhosts, so no vhost binds a different set — one that did would be
reachable on a port the gateway does not consider its own.
'';
};
privateListen = lib.mkOption {
type = lib.types.listOf (lib.types.attrsOf lib.types.raw);
internal = true;
readOnly = true;
description = ''
Read-only: the `listen` set of a vhost with `public = false`: the
same port pair, on `privateListenAddresses` only.
'';
};
@ -319,6 +342,45 @@ in
'';
};
privateListenAddresses = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [
"10.100.0.1"
"fd00:100::1"
];
description = ''
Addresses of this host, IPv4 or IPv6 (bare `fd00::1` or bracketed),
that the vhosts with `public = false` listen on, on `port` and
`httpsPort`. Not the wildcard: `0.0.0.0` and `::` are refused,
since they would open those vhosts on the public address too.
The vhosts that stay public listen on these addresses as well as on
the wildcard, so a client that reaches the host by a private address
still gets them; and so does the catch-all, so an unknown `Host` on a
private address closes the connection rather than being served by
a private vhost.
The addresses must exist on the host when nginx starts (a
WireGuard interface's address, say), or nginx fails to bind. Empty
by default: every vhost is public, as before.
'';
};
listenIPv6 = lib.mkOption {
type = lib.types.bool;
default = config.networking.enableIPv6;
defaultText = lib.literalExpression "config.networking.enableIPv6";
description = ''
Listen on `[::]` as well as `0.0.0.0`, on `port` and `httpsPort`.
The IPv6 listener takes IPv6 connections only; the `0.0.0.0` one
keeps the IPv4 ones. Follows `networking.enableIPv6`; set it to
`false` on a host whose kernel cannot open an IPv6 socket.
`openFirewall` opens the ports for both address families.
'';
};
statusPort = lib.mkOption {
type = lib.types.port;
default = 8085;