vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-gateway: no hive-domain vhost on a host without a hive

Browse source 
The hive-domain vhost renders only where a hive runs. On a host without
one the only certificate is the swarm-services leaf, which does not name
the hive domain, so a homeserver host without a hive serves matrix on the
homeserver's own name only; apex matrix discovery is #4878.

Comments and test names describe the code's current behaviour.

Refs #4588
This commit is contained in:
atlas 2026-10-04 18:57:12 +02:00 • committed by mara
commit 01ec29da48
6 changed files with 68 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

42
nix/module-eval/swarm-services-switch.nix
View file

@ -45,8 +45,7 @@ let
deploy.bao.enable = true;
};
# The homeserver on a host without a hive: its hive-domain vhost serves
# matrix discovery and nothing of the hive's.
# The homeserver on a host without a hive.
matrixNoHive = hive {
deploy.hive-controller.enable = false;
deploy.matrix.enable = true;
@ -240,24 +239,27 @@ let
!(lib.any (t: lib.any (r: lib.hasInfix r t) hiveLeafRefs) texts)
&& m.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile == null
&& noHiveSurface m;
# The hive-domain vhost, where it renders at all, carries nothing
# that proxies to hive-c0re.
# No hive-domain vhost, and no vhost on the host carrying the
# hive's locations: c0re's `/health/`, the agent routes, swagger,
# or the hive domain's matrix discovery and `/matrix/` redirect.
noHiveSurface =
m:
let
vh = m.services.nginx.virtualHosts;
v = vh."h1.t.local";
in
!(vh ? "h1.t.local")
|| (
!(lib.any (l: v.locations ? ${l}) [
"/"
"/api/"
&& !(lib.any (
v:
lib.any (l: (v.locations or { }) ? ${l}) [
"/health/"
"/agent/"
"/api/docs/"
])
&& !(lib.hasInfix "agents.conf" (v.extraConfig or ""))
);
"/matrix/"
"= /.well-known/matrix/client"
"= /.well-known/matrix/server"
]
|| lib.hasInfix "agents.conf" (v.extraConfig or "")
) (lib.attrValues vh));
noHive =
m:
let
@ -302,14 +304,15 @@ let
store.services.hyperhive.swarm.localServiceDomains
== [ store.services.hyperhive.swarm.bao.ui.domain ]
&& !(waitsForLeaf store)
# The homeserver without a hive: the hive-domain vhost serves matrix
# discovery and the redirect, and no hive surface.
# The homeserver without a hive: no hive-domain vhost at all, and the
# homeserver's own vhost still proxies `/_matrix/`.
&& noHive matrixNoHive
&& (
let
l = matrixNoHive.services.nginx.virtualHosts."h1.t.local".locations;
gh = matrixNoHive.services.hyperhive.swarm.matrix.gatewayHost;
vh = matrixNoHive.services.nginx.virtualHosts;
in
l ? "= /.well-known/matrix/client" && l ? "= /.well-known/matrix/server"
gh != null && vh ? ${gh} && lib.any (lib.hasPrefix "/_matrix") (lib.attrNames vh.${gh}.locations)
)
&& !(store.services.nginx.virtualHosts ? "h1.t.local")
&& lib.hasInfix "want_svc=1" store.systemd.services.swarm-services-cert.script
@ -318,7 +321,12 @@ let
&& hs ? hive-tls-resign
&& lib.hasInfix "install -m 0644 /var/lib/hive-tls/gateway.pem /var/lib/hive-gateway/tls/cert.pem" hs.hive-gateway-self-signed-cert.script
&& swarmServicesHere.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile != null
&& swarmServicesHere.services.nginx.virtualHosts."h1.t.local".locations ? "/api/"
&& (
let
l = swarmServicesHere.services.nginx.virtualHosts."h1.t.local".locations;
in
l ? "/api/" && l ? "/health/" && l ? "= /.well-known/matrix/client"
)
&& !(noHiveLeafAnywhere swarmServicesHere);
}
{