mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: per-vhost public flag, private listen addresses, and IPv6 listeners

Browse source
This commit is contained in:
atlas 2026-11-09 21:38:36 +01:00
commit fbbdf26a19
1 changed files with 364 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nix/host-modules/hive-gateway/vhost-lib.nix
View file

@ -11,7 +11,8 @@
#
# Pure function of the gateway's config + resolved cert paths; returns
# an attrset, evaluates no options itself. Everything here is *gateway*
# knowledge — which port pair to bind, which issuer covers a name.
# knowledge — which addresses and port pair to bind, which issuer covers a
# name.
{
lib,
cfg, # services.hyperhive.gateway
@ -24,6 +25,8 @@
caBundle, # hive TLS trust bundle on the host
}:
let
listenSets = import ./listen.nix { inherit lib; };
# nixos `services.nginx.virtualHosts.<name>` ssl attrs for a vhost
# covered by the hive's own cert. For ACME mode: `enableACME` +
# `addSSL` — NixOS's ACME integration manages the cert lifecycle and
@ -52,18 +55,13 @@ in
# floor when neither `tls.certDir` nor ACME is set, so there is no
# http-only mode. Listen addresses every vhost shares — plain http
# on `cfg.port` plus TLS on `cfg.httpsPort`. See `docs/4-implementation/networking/gateway.md`
# ("TLS modes").
listen = [
{
addr = "0.0.0.0";
port = cfg.port;
}
{
addr = "0.0.0.0";
port = cfg.httpsPort;
ssl = true;
}
];
# ("TLS modes", "Listen addresses").
#
# `listen` is for a vhost that answers everywhere: the wildcard plus the
# private addresses. `privateListen` is for one that answers only on the
# private addresses.
listen = listenSets.public cfg;
privateListen = listenSets.private cfg;
# TLS attrs for one vhost, by name. A swarm service's name may sit
# outside this hive's domain — and then the hive leaf's role