vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(#2245): drop TCP fallback from gateway nginx upstream

Browse source 
Agents run in private netns (always-on isolation). The TCP fallback
to 127.0.0.1:<port> was unreachable from the gateway's host netns
regardless of whether the per-agent socket marker existed.

Remove the conditional entirely: always use the unix socket path.
If the socket is not yet bound, nginx returns 502 which is already
handled by the error_page 502 503 504 = /__hive_agent_unreachable
directive in every location block.

Also removes the unused lifecycle::agent_web_port call and the
now-misleading '.bound state' mention from the render doc comment.
This commit is contained in:
atlas 2026-07-04 22:01:25 +02:00 • committed by mara
commit 0456206e52
1 changed files with 25 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

51
hive-c0re/src/gateway_nginx.rs
View file

@ -1,7 +1,7 @@
//! Runtime nginx include-file generator for the gateway's per-agent //! Runtime nginx include-file generator for the gateway's per-agent
//! `/agent/<name>/` location blocks. Writes //! `/agent/<name>/` location blocks. Writes
//! `/var/lib/hyperhive/gateway/agents.conf` on every topology change. //! `/var/lib/hyperhive/gateway/agents.conf` on every topology change.
//! UDS vs TCP upstream selection, reload trigger (`systemd-run //! UDS upstream selection, reload trigger (`systemd-run
//! --machine=hive-gateway`), and idempotency: //! --machine=hive-gateway`), and idempotency:
//! `docs/gateway.md::Per-agent unix-socket upstream`. //! `docs/gateway.md::Per-agent unix-socket upstream`.
@ -14,7 +14,6 @@ use std::time::{SystemTime, UNIX_EPOCH};
use crate::priv_client; use crate::priv_client;
use crate::agent_sockets; use crate::agent_sockets;
use crate::lifecycle;
/// Set when `write` publishes a new agents.conf; cleared when /// Set when `write` publishes a new agents.conf; cleared when
/// `reload_gateway_nginx` submits the reload command successfully. /// `reload_gateway_nginx` submits the reload command successfully.
@ -74,12 +73,11 @@ const PROXY_HEADER_BLOCK: &str = " proxy_http_version 1.1;
/// When `frontend_dir` is `None` (legacy) each agent gets a single /// When `frontend_dir` is `None` (legacy) each agent gets a single
/// `location /agent/<name>/` proxy block. /// `location /agent/<name>/` proxy block.
/// ///
/// Output is deterministic for the same (sorted) set of names + /// Output is deterministic for the same (sorted) set of names:
/// `.bound` state: no timestamps, no UUIDs. `BTreeMap` would give /// no timestamps, no UUIDs. `BTreeMap` would give alphabetical order;
/// alphabetical order; we rely on the caller to pass sorted names if /// we rely on the caller to pass sorted names if they care about diff
/// they care about diff stability, but the gateway treats the blocks /// stability, but the gateway treats the blocks as unordered by nginx's
/// as unordered by nginx's longest-prefix-match rules so ordering only /// longest-prefix-match rules so ordering only affects human readability.
/// affects human readability.
fn render(names: &[String], frontend_dir: Option<&str>) -> String { fn render(names: &[String], frontend_dir: Option<&str>) -> String {
let mut out = String::from( let mut out = String::from(
"# Generated by hive-c0re \u{2014} do not edit.\ "# Generated by hive-c0re \u{2014} do not edit.\
@ -87,24 +85,20 @@ fn render(names: &[String], frontend_dir: Option<&str>) -> String {
\n# Reload triggered by hive-c0re via systemd-run --machine=hive-gateway.\n", \n# Reload triggered by hive-c0re via systemd-run --machine=hive-gateway.\n",
); );
for name in names { for name in names {
let port = lifecycle::agent_web_port(name);
// Two upstream forms because named locations (split mode's // Two upstream forms because named locations (split mode's
// `@<name>_dynamic`) forbid a URI part on `proxy_pass`. The // `@<name>_dynamic`) forbid a URI part on `proxy_pass`. The
// legacy prefix-location path keeps the trailing `/` so nginx // legacy prefix-location path keeps the trailing `/` so nginx
// strips `/agent/<name>/` automatically; the named-location // strips `/agent/<name>/` automatically; the named-location
// path strips the prefix via `rewrite` and uses a bare upstream. // path strips the prefix via `rewrite` and uses a bare upstream.
let (upstream_prefix, upstream_bare) = if agent_sockets::ready_marker_for(name).exists() { //
let sock = agent_sockets::socket_path_for(name).display().to_string(); // Always use the unix socket path. The old TCP fallback
( // (`127.0.0.1:<port>`) was removed: agents run in private netns
format!("http://unix:{sock}:/"), // (always-on isolation) so the host loopback is unreachable from
format!("http://unix:{sock}:"), // the gateway's netns. When the socket is not yet bound, nginx
) // returns 502 which is handled by the error_page directive below.
} else { let sock = agent_sockets::socket_path_for(name).display().to_string();
( let upstream_prefix = format!("http://unix:{sock}:/");
format!("http://127.0.0.1:{port}/"), let upstream_bare = format!("http://unix:{sock}:");
format!("http://127.0.0.1:{port}"),
)
};
if let Some(frontend) = frontend_dir { if let Some(frontend) = frontend_dir {
// Split mode: try to serve files from the nix-store dist first; // Split mode: try to serve files from the nix-store dist first;
@ -303,14 +297,19 @@ mod tests {
} }
#[test] #[test]
fn render_tcp_upstream_when_no_bound_marker() { fn render_uds_upstream_unconditional() {
// No .bound file on disk → falls back to TCP loopback. // TCP fallback removed — always UDS regardless of socket marker.
let names = vec!["iris".to_owned()]; let names = vec!["iris".to_owned()];
let body = render(&names, None); let body = render(&names, None);
let port = lifecycle::agent_web_port("iris"); // UDS form present
assert!( assert!(
body.contains(&format!("proxy_pass http://127.0.0.1:{port}/")), body.contains("proxy_pass http://unix:"),
"expected TCP upstream for iris, got:\n{body}" "expected UDS upstream for iris, got:\n{body}"
);
// No TCP loopback fallback
assert!(
!body.contains("127.0.0.1"),
"unexpected TCP loopback in output:\n{body}"
); );
} }