From 0a376321bfd6d12e28efe3375ae2e5f96df5f168 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive>
Date: Sat, 30 May 2026 12:35:18 +0200
Subject: [PATCH] nix/hive-c0re: gate direct c0re port firewall opens on
 gateway.enable (#621)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per #621 (filed as follow-up to #620 v0): when the gateway is on
(now the default), the c0re dashboard / manager / sub-agent direct
ports should NOT be open in the host firewall — the gateway nginx
is the sole external entry point, proxying to `127.0.0.1:7000` etc.
internally. Leaving them open in the firewall defeats the "single
front door" story.

Wraps the existing `allowedTCPPorts` + `allowedTCPPortRanges` blocks
in `lib.mkIf (!config.services.hyperhive.gateway.enable)`. Operators
who opt out of the gateway still get the direct ports opened so the
legacy `http://<host>:7000/` flow keeps working.

Verified via `nix eval`:

| gateway | allowedTCPPorts (host firewall) | allowedTCPPortRanges |
| --- | --- | --- |
| on  | `[80 2222 3000]` (gateway + forge) | `[]` |
| off | `[2222 3000 7000 8000]` (forge + c0re + manager) | `[{from=8100; to=8999}]` (agents) |

Forge ports stay direct in both modes — `hive-forge.nix` opens them
independently and they're not proxied through the gateway (that's a
separate follow-up if wanted).

Closes #621.
---
 nix/modules/hive-c0re.nix | 36 +++++++++++++++++++++++-------------
 1 file changed, 23 insertions(+), 13 deletions(-)

diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index 19863253..c5aeacce 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -195,19 +195,29 @@ in
     ];
 
     # Dashboard + per-container web UIs share the host's network namespace and
-    # need their ports reachable. Dashboard: `cfg.dashboardPort` (default 7000).
-    # Manager: 8000. Sub-agents: 8100..8999 (deterministic hash; see
-    # `lifecycle::agent_web_port`).
-    networking.firewall.allowedTCPPorts = [
-      cfg.dashboardPort
-      8000
-    ];
-    networking.firewall.allowedTCPPortRanges = [
-      {
-        from = 8100;
-        to = 8999;
-      }
-    ];
+    # need their ports reachable when there's no gateway in front. Dashboard:
+    # `cfg.dashboardPort` (default 7000). Manager: 8000. Sub-agents: 8100..8999
+    # (deterministic hash; see `lifecycle::agent_web_port`).
+    #
+    # When `services.hyperhive.gateway.enable = true` (the default), the
+    # gateway nginx is the sole external entry point and proxies to
+    # `127.0.0.1:7000` etc. internally — leaving the direct ports open
+    # in the host firewall would defeat the gateway's "single front
+    # door" story (closes #621). Operators who opt out of the gateway
+    # still get the direct ports opened so the legacy
+    # `http://<host>:7000/` flow works.
+    networking.firewall = lib.mkIf (!config.services.hyperhive.gateway.enable) {
+      allowedTCPPorts = [
+        cfg.dashboardPort
+        8000
+      ];
+      allowedTCPPortRanges = [
+        {
+          from = 8100;
+          to = 8999;
+        }
+      ];
+    };
 
     systemd.services.hive-c0re = {
       description = "hyperhive coordinator daemon";