vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-gateway: no hive-domain vhost on a host without a hive

Browse source 
The hive-domain vhost renders only where a hive runs. On a host without
one the only certificate is the swarm-services leaf, which does not name
the hive domain, so a homeserver host without a hive serves matrix on the
homeserver's own name only; apex matrix discovery is #4878.

Comments and test names describe the code's current behaviour.

Refs #4588
This commit is contained in:
atlas 2026-10-04 18:57:12 +02:00 • committed by mara
commit 01ec29da48
6 changed files with 68 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

50
nix/host-modules/hive-gateway/vhosts.nix
View file

@ -248,34 +248,32 @@ in
'';
};
}
// lib.optionalAttrs (runsHive || matrixDeployCfg.enable) {
// lib.optionalAttrs runsHive {
# The hive domain's own vhost, reachable by NAME, so the catch-all can
# reject everything else. It exists where it has something to serve:
# matrix discovery and the `/matrix/` redirect where the homeserver runs
# here, and the dashboard, agent routes and swagger UI where a hive runs
# (they proxy to hive-c0re, which runs only with the hive controller).
# reject everything else. Only where a hive runs: the dashboard, agent
# routes and swagger UI proxy to hive-c0re, which runs only with the hive
# controller, and the certificate naming the hive domain is the hive
# leaf, which exists only there.
${hyperhiveDomain} = (vhostTlsFor hyperhiveDomain) // {
listen = vhostListen;
locations =
matrixRedirectLocations
// wellKnownLocations
// lib.optionalAttrs runsHive (
agentLocations
// dashboardProxyLocation
// swaggerUiLocations
// lib.optionalAttrs cfg.auth.enable {
# Internal-only target for the dashboard's 401 error_page.
# `internal` prevents direct client access; `alias` serves
# the pre-built HTML from the Nix store.
"= /__hive_auth_unauthorized" = {
extraConfig = ''
internal;
alias ${errorPages.unauthorized};
default_type text/html;
'';
};
}
);
// agentLocations
// dashboardProxyLocation
// swaggerUiLocations
// lib.optionalAttrs cfg.auth.enable {
# Internal-only target for the dashboard's 401 error_page.
# `internal` prevents direct client access; `alias` serves
# the pre-built HTML from the Nix store.
"= /__hive_auth_unauthorized" = {
extraConfig = ''
internal;
alias ${errorPages.unauthorized};
default_type text/html;
'';
};
};
# Per-agent location blocks, generated at runtime by
# hive-c0re and written to /var/lib/hive-gateway/conf/agents.conf
# on the host — the same machine nginx runs on. nginx parses
@ -284,11 +282,9 @@ in
# agents without a nixos-rebuild. nginx's longest-prefix-
# match rule ensures `/agent/<name>/` from this file beats
# the `/agent/` catch-all above.
extraConfig =
securityHeaders
+ lib.optionalString runsHive ''
include /var/lib/hive-gateway/conf/agents.conf;
'';
extraConfig = securityHeaders + ''
include /var/lib/hive-gateway/conf/agents.conf;
'';
};
};
}