vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nix/hive-c0re: gate direct c0re port firewall opens on gateway.enable (#621)

Browse source 
Per #621 (filed as follow-up to #620 v0): when the gateway is on
(now the default), the c0re dashboard / manager / sub-agent direct
ports should NOT be open in the host firewall — the gateway nginx
is the sole external entry point, proxying to `127.0.0.1:7000` etc.
internally. Leaving them open in the firewall defeats the "single
front door" story.

Wraps the existing `allowedTCPPorts` + `allowedTCPPortRanges` blocks
in `lib.mkIf (!config.services.hyperhive.gateway.enable)`. Operators
who opt out of the gateway still get the direct ports opened so the
legacy `http://<host>:7000/` flow keeps working.

Verified via `nix eval`:

| gateway | allowedTCPPorts (host firewall) | allowedTCPPortRanges |
| --- | --- | --- |
| on  | `[80 2222 3000]` (gateway + forge) | `[]` |
| off | `[2222 3000 7000 8000]` (forge + c0re + manager) | `[{from=8100; to=8999}]` (agents) |

Forge ports stay direct in both modes — `hive-forge.nix` opens them
independently and they're not proxied through the gateway (that's a
separate follow-up if wanted).

Closes #621.
This commit is contained in:
atlas 2026-05-30 12:35:18 +02:00 • committed by Mara
commit 0a376321bf
1 changed files with 23 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

36
nix/modules/hive-c0re.nix
View file

@ -195,19 +195,29 @@ in
];
# Dashboard + per-container web UIs share the host's network namespace and
# need their ports reachable. Dashboard: `cfg.dashboardPort` (default 7000).
# Manager: 8000. Sub-agents: 8100..8999 (deterministic hash; see
# `lifecycle::agent_web_port`).
networking.firewall.allowedTCPPorts = [
cfg.dashboardPort
8000
];
networking.firewall.allowedTCPPortRanges = [
{
from = 8100;
to = 8999;
}
];
# need their ports reachable when there's no gateway in front. Dashboard:
# `cfg.dashboardPort` (default 7000). Manager: 8000. Sub-agents: 8100..8999
# (deterministic hash; see `lifecycle::agent_web_port`).
#
# When `services.hyperhive.gateway.enable = true` (the default), the
# gateway nginx is the sole external entry point and proxies to
# `127.0.0.1:7000` etc. internally — leaving the direct ports open
# in the host firewall would defeat the gateway's "single front
# door" story (closes #621). Operators who opt out of the gateway
# still get the direct ports opened so the legacy
# `http://<host>:7000/` flow works.
networking.firewall = lib.mkIf (!config.services.hyperhive.gateway.enable) {
allowedTCPPorts = [
cfg.dashboardPort
8000
];
allowedTCPPortRanges = [
{
from = 8100;
to = 8999;
}
];
};
systemd.services.hive-c0re = {
description = "hyperhive coordinator daemon";