vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-gateway: no hive-domain vhost on a host without a hive

Browse source 
The hive-domain vhost renders only where a hive runs. On a host without
one the only certificate is the swarm-services leaf, which does not name
the hive domain, so a homeserver host without a hive serves matrix on the
homeserver's own name only; apex matrix discovery is #4878.

Comments and test names describe the code's current behaviour.

Refs #4588
This commit is contained in:
atlas 2026-10-04 18:57:12 +02:00 • committed by mara
commit 01ec29da48
6 changed files with 68 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/module-eval/hive-tls.nix
View file

@ -231,10 +231,10 @@ let
&& lib.hasInfix "root-key.pem" rootScript;
}
{
# Left for PR 3, beside dropping `ca.pem`, so a rollback finds the old
# key and does not mint a new anchor. The control is the bundle reading
# `ca.pem` in the same script.
name = "a retired hive CA key is left in place, and its public certificate stays in the trust bundle";
# Nothing reads or removes a `ca-key.pem`, so a rollback finds the
# key and does not mint a new anchor. The control is the bundle
# reading `ca.pem` in the same script.
name = "a hive CA key is neither read nor removed, and its public certificate stays in the trust bundle";
ok =
!(lib.hasInfix "ca-key.pem" caUnit.script)
&& !(lib.hasInfix "ca-key.pem" leafUnit.script)
@ -281,8 +281,6 @@ let
&& !(lib.hasInfix "(unset)" ok');
}
{
# A leaf the retired hive CA signed is re-issued from the store on the
# first run that reaches it; one that renews in time never is.
# A cert from one issuance beside the key of another, left by an
# interrupted pair of renames, is re-issued rather than left for
# `nginx -t` to refuse. Checked on the decision side of the exit.