vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-gateway: no hive-domain vhost on a host without a hive

Browse source 
The hive-domain vhost renders only where a hive runs. On a host without
one the only certificate is the swarm-services leaf, which does not name
the hive domain, so a homeserver host without a hive serves matrix on the
homeserver's own name only; apex matrix discovery is #4878.

Comments and test names describe the code's current behaviour.

Refs #4588
This commit is contained in:
atlas 2026-10-04 18:57:12 +02:00 • committed by mara
commit 01ec29da48
6 changed files with 68 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/hive-tls.nix
View file

@ -594,15 +594,10 @@ in
# The swarm-services leaf, issued by the secret store's `pki` mount.
#
# ⚠️ This unit replaces a chain, not a command. What used to happen
# was two openssl hops on whichever host held the swarm root key: a
# name-constrained `swarm-services` sub-CA (../swarm-ca.nix), then a
# leaf signed under it here. Both are gone. The store's
# `pki/roles/swarm-services` carries the same narrowing as an
# `allowed_domains` list enforced at issue time, so the intermediate
# that used to encode it in x509 `nameConstraints` has nothing left
# to express — and with the root inside the mount there is nothing
# for it to be an intermediate OF.
# The leaf chains straight to the mount's root, with no intermediate:
# the store's `pki/roles/swarm-services` narrows the names with an
# `allowed_domains` list enforced at issue time, so there is no x509
# `nameConstraints` for an intermediate to carry.
#
# The names it may carry are not this unit's to assert: the role
# refuses anything outside `allowed_domains`, read from the
@ -613,14 +608,10 @@ in
systemd.services.swarm-services-cert = {
description = "Issue the swarm-services TLS leaf from the secret store's PKI";
wantedBy = [ "multi-user.target" ];
# ⚠️ The ordering the old shape got by ACCIDENT, written down.
# Nothing used to declare "no TLS until the store is up" — it held
# because `swarm-services-ca.service` happened to block the gateway.
# Now it is a real edge: the gateway's certificate comes out of the
# store, so the store being up is a precondition rather than a
# coincidence, and `requiredBy` is what makes a store that never
# comes up an outage that says so instead of a gateway serving the
# wrong name.
# ⚠️ Where the gateway waits for this leaf, the store being up is a
# precondition of the gateway's certificate, and `requiredBy` is
# what makes a store that never comes up an outage that says so
# instead of a gateway serving the wrong name.
#
# 🩸 NOT `Before=hive-tls-ca.service`, however much the trust bundle
# wants it. That edge closed a cycle — the store's container is