From 0c6e8fc5a28dfce4074ff549a85f6f273d98afad Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 26 Oct 2026 16:06:11 +0100 Subject: [PATCH] move hiveName to deploy.hive-controller; only a hive host needs a name --- README.md | 2 +- docs/networking/gateway.md | 4 +- docs/networking/network.md | 2 +- docs/process/conventions.md | 2 +- docs/swarm/README.md | 6 +- hive-agent-mcp/src/mcp/mod.rs | 2 +- hive-agent/src/identity.rs | 2 +- hive-c0re/src/container_view.rs | 2 +- hive-c0re/src/dashboard/state_snapshot.rs | 2 +- hive-c0re/src/swarm_status.rs | 4 +- hive-host-sock/src/lib.rs | 2 +- hivectl/src/wg.rs | 35 ++++- nix/host-modules/deploy.nix | 39 +++++ .../glue-bao-readers-store-order.nix | 4 +- nix/host-modules/glue-bao-tls.nix | 43 +++--- .../glue-controller-bao-identity.nix | 25 ++-- nix/host-modules/glue-hive-otel-authelia.nix | 4 +- .../glue-matrix-hive-discovery.nix | 2 +- .../glue-secret-publisher-bao-identity.nix | 19 ++- nix/host-modules/hive-c0re/environment.nix | 10 +- nix/host-modules/hive-c0re/vhosts.nix | 4 +- nix/host-modules/hive-forge/default.nix | 6 +- nix/host-modules/hive-gateway/default.nix | 2 +- nix/host-modules/hive-gateway/dnsmasq.nix | 25 ++-- nix/host-modules/hive-gateway/options.nix | 2 +- nix/host-modules/hive-matrix.nix | 9 +- nix/host-modules/hive-network.nix | 2 +- nix/host-modules/hive-tls.nix | 19 ++- nix/host-modules/hyperhive.nix | 104 +++++++------ nix/host-modules/otel.nix | 13 +- nix/host-modules/swarm-bao.nix | 7 +- nix/host-modules/swarm-ui.nix | 2 +- nix/host-modules/swarm-wireguard.nix | 2 +- nix/host-modules/swarm.nix | 56 +------ nix/module-eval/core-toggle.nix | 138 ++++++++++++++++-- nix/module-eval/hive-otel.nix | 13 ++ nix/module-eval/lib.nix | 2 +- 37 files changed, 402 insertions(+), 215 deletions(-) diff --git a/README.md b/README.md index 1af16814..e403e469 100644 --- a/README.md +++ b/README.md @@ -131,7 +131,7 @@ covers spreading a swarm across hosts. deploy.hive-controller.enable = true; # …and a hive to run agents on swarm.domain = "hive.example"; # the swarm's DNS domain - hiveName = "pr1ma"; # this hive's label in it + deploy.hive-controller.hiveName = "pr1ma"; # this hive's label in it swarm.hives.pr1ma = { }; # the directory: just us }; diff --git a/docs/networking/gateway.md b/docs/networking/gateway.md index 068abac6..3decc6c5 100644 --- a/docs/networking/gateway.md +++ b/docs/networking/gateway.md @@ -24,7 +24,7 @@ You rarely switch it on yourself. `gateway.enable` defaults to off, and every mo A service module declares its vhost as `services.hyperhive.gateway.vhosts.`: the locations, `forceSSL` and any `extraConfig` it needs. The gateway renders it into `services.nginx.virtualHosts.` and adds the `listen` set, the certificate for that name and the [security headers](#security-headers) (ahead of the vhost's own `extraConfig`), and drops `addSSL` from a vhost that sets `forceSSL`. The eval fails for a vhost that sets `listen`, `addSSL`, `onlySSL`, `enableACME`, `useACMEHost`, `sslCertificate` or `sslCertificateKey` itself, and for any vhost declared while `gateway.enable` is false. A name with a certificate from outside the gateway's leaves (the queue's) sets `certificate = { cert; key; }` instead. `hive-gateway/vhosts.nix` declares the gateway's own catch-all (`_`) the same way, `hive-c0re/vhosts.nix` the dashboard and the hive domain, and `glue-matrix-hive-discovery.nix` adds the matrix redirect to the hive domain where the homeserver runs, and discovery there when the hive domain is the pinned server name. The catch-all sets `securityHeaders = false` because it sends no response, and the gateway renders a vhost's `default` at `mkDefault` priority. -**The hive's own vhosts**: the dashboard's, named `.hives.` (`swarm.dashboardDomain`), and one named for the hive domain. They exist only on a host that runs a hive (`deploy.hive-controller.enable`); a host without a hive has none of these rows: +**The hive's own vhosts**: the dashboard's, named `.hives.` (`deploy.hive-controller.dashboardDomain`), and one named for the hive domain. They exist only on a host that runs a hive (`deploy.hive-controller.enable`); a host without a hive has none of these rows: | URL | upstream | when | | --- | --- | --- | @@ -116,7 +116,7 @@ Give the gateway the real cert (`tls.certDir` or `tls.acme`) so it serves proper ## Dashboard access -The dashboard answers on `.hives.` (`swarm.dashboardDomain`, derived from the hive name and `swarm.domain`), behind an authelia `auth_request`. Log in with your authelia account; only accounts in the `admins` group get in, the same rule as the swarm UI. Add one with `swarmctl user add --group admins` ([`swarm/sso.md`](../swarm/sso.md)). +The dashboard answers on `.hives.` (`deploy.hive-controller.dashboardDomain`, derived from the hive name and `swarm.domain`), behind an authelia `auth_request`. Log in with your authelia account; only accounts in the `admins` group get in, the same rule as the swarm UI. Add one with `swarmctl user add --group admins` ([`swarm/sso.md`](../swarm/sso.md)). The name sits under the swarm domain so authelia's session cookie reaches it, whatever the hive's own domain is. Any path on the hive domain other than the matrix routes redirects there, so old bookmarks still land. diff --git a/docs/networking/network.md b/docs/networking/network.md index 0025ad18..cf0087c2 100644 --- a/docs/networking/network.md +++ b/docs/networking/network.md @@ -88,7 +88,7 @@ listener sits on `bridgeIp`, on the host's bridge interface. { services.hyperhive = { deploy.hive-controller.enable = true; - hiveName = "pr1ma"; + deploy.hive-controller.hiveName = "pr1ma"; swarm.domain = "darkest.space"; swarm.hives.pr1ma = { }; # -> domain = pr1ma.darkest.space # network.bridgeIp = "10.42.0.1"; # default diff --git a/docs/process/conventions.md b/docs/process/conventions.md index 89617c38..36551b01 100644 --- a/docs/process/conventions.md +++ b/docs/process/conventions.md @@ -232,7 +232,7 @@ status_text, status_set_at, hive_name, swarm_name, matrix_accounts }`: or when `running = false` (see above). - `hive_name` / `swarm_name`: display names read from `HYPERHIVE_HIVE_NAME` / `HYPERHIVE_SWARM_NAME` env (sourced from - `services.hyperhive.hiveName` / `services.hyperhive.swarm.name`). + `services.hyperhive.deploy.hive-controller.hiveName` / `services.hyperhive.swarm.name`). Both `None` when the options aren't configured. - `matrix_accounts`: one `MatrixIdentity` per configured + live matrix account the agent can act as. Empty for agents with no matrix diff --git a/docs/swarm/README.md b/docs/swarm/README.md index ce2a5981..32977391 100644 --- a/docs/swarm/README.md +++ b/docs/swarm/README.md @@ -485,7 +485,7 @@ refused delivery logs `webhook: refused delivery` with the reason. ```nix services.hyperhive = { swarm.domain = "example.com"; # required — the swarm's DNS domain - hiveName = "pr1ma"; # required — this hive's label in it + deploy.hive-controller.hiveName = "pr1ma"; # required on a hive host — this hive's label in it swarm.name = "constellat1on"; # shared swarm display name (optional) # required — the directory, identical on every host in the swarm. @@ -503,7 +503,7 @@ services.hyperhive = { Swarm options are identical on every host in the swarm, so `swarm.domain` is **required** on every host that runs any hyperhive service; a host that imports the module and enables nothing evaluates without it. `hiveName` is -required on a host that runs a hive, the secret store or the homeserver. Eval fails with a hint naming +required on a host that runs a hive (`deploy.hive-controller.hiveName`), and on no other. Eval fails with a hint naming each. Neither defaults, because a guessed value here is a wrong hostname that evaluates cleanly and deploys. @@ -518,7 +518,7 @@ directory without this host would make every hive a peer, itself included. ``` # hive A # hive B -hiveName = "pr1ma"; hiveName = "edge"; +deploy.hive-controller.hiveName = "pr1ma"; deploy.hive-controller.hiveName = "edge"; swarm.hives = { … }; swarm.hives = { … }; # byte-identical ``` diff --git a/hive-agent-mcp/src/mcp/mod.rs b/hive-agent-mcp/src/mcp/mod.rs index 3342d99a..d5faaada 100644 --- a/hive-agent-mcp/src/mcp/mod.rs +++ b/hive-agent-mcp/src/mcp/mod.rs @@ -313,7 +313,7 @@ impl AgentServer { and the target's self-reported `status` text (set via `set_status`) plus how \ long ago it was set. Also returns the hive + swarm display names (`hive_name`, \ `swarm_name`) when the operator has configured \ - `services.hyperhive.hiveName` / `services.hyperhive.swarm.name`; both lines \ + `services.hyperhive.deploy.hive-controller.hiveName` / `services.hyperhive.swarm.name`; both lines \ omitted when unset. Pass `name` to query a peer (e.g. \ check whether iris is idle before pinging them); omit `name` to get your own \ identity stamp — handy for state files / commit messages / cross-agent \ diff --git a/hive-agent/src/identity.rs b/hive-agent/src/identity.rs index e9ee2ed0..02456b19 100644 --- a/hive-agent/src/identity.rs +++ b/hive-agent/src/identity.rs @@ -32,7 +32,7 @@ pub fn hive_domain() -> Option { /// [`hive_domain`] — the domain is the machine-readable DNS address; /// this is the prose label humans use in conversation. Reads the /// `HYPERHIVE_HIVE_NAME` env var; returns None when it is unset or empty -/// (the host's `services.hyperhive.hiveName` is unset), in which case +/// (the host's `services.hyperhive.deploy.hive-controller.hiveName` is unset), in which case /// callers fall back to the domain or the short label at their discretion. #[must_use] pub fn hive_name() -> Option { diff --git a/hive-c0re/src/container_view.rs b/hive-c0re/src/container_view.rs index 983e9937..eb3703bd 100644 --- a/hive-c0re/src/container_view.rs +++ b/hive-c0re/src/container_view.rs @@ -361,7 +361,7 @@ fn read_active_model(name: &hive_types::Ident) -> Option { /// Host-side hive + swarm display names, read from the c0re service's /// own process env. The hyperhive NixOS module sets these from -/// `services.hyperhive.hiveName` + `services.hyperhive.swarm.name` +/// `services.hyperhive.deploy.hive-controller.hiveName` + `services.hyperhive.swarm.name` /// (the hive names itself; the swarm it joins is named one level out). /// The agent-side /// `hive-agent::identity::{hive_name, swarm_name}` accessors read the diff --git a/hive-c0re/src/dashboard/state_snapshot.rs b/hive-c0re/src/dashboard/state_snapshot.rs index 6308a88a..c4f1eb24 100644 --- a/hive-c0re/src/dashboard/state_snapshot.rs +++ b/hive-c0re/src/dashboard/state_snapshot.rs @@ -89,7 +89,7 @@ pub(super) struct StateSnapshot { authelia_public_url: Option, /// Human name of this single-host hive instance (e.g. `"pr1ma"`). /// Sourced from `HYPERHIVE_HIVE_NAME` env var, set by the c0re - /// NixOS module from `services.hyperhive.hiveName`. `None` when + /// NixOS module from `services.hyperhive.deploy.hive-controller.hiveName`. `None` when /// the option is unset — chrome falls back to `hostname`. hive_name: Option, /// Human name of the wider swarm this hive belongs to (e.g. diff --git a/hive-c0re/src/swarm_status.rs b/hive-c0re/src/swarm_status.rs index f3f0d4d6..07d3881e 100644 --- a/hive-c0re/src/swarm_status.rs +++ b/hive-c0re/src/swarm_status.rs @@ -16,8 +16,8 @@ //! same host, each internally consistent. //! //! **The key is this hive's `hiveName`.** Nothing here has to arrange for -//! that to match the controller's roster: `swarm.nix` asserts that -//! `services.hyperhive.hiveName` is a key of `services.hyperhive.swarm.hives`, +//! that to match the controller's roster: `hyperhive.nix` asserts that +//! `services.hyperhive.deploy.hive-controller.hiveName` is a key of `services.hyperhive.swarm.hives`, //! so a hive that evaluates at all publishes under a name the roster //! knows. The alternative — a key the controller has never heard of — //! renders as `unknown` rather than being silently dropped, but the diff --git a/hive-host-sock/src/lib.rs b/hive-host-sock/src/lib.rs index d490a82d..4d5af3f3 100644 --- a/hive-host-sock/src/lib.rs +++ b/hive-host-sock/src/lib.rs @@ -387,7 +387,7 @@ pub struct HiveUrls { /// Canonical hive domain (`services.hyperhive.domain`). #[serde(default, skip_serializing_if = "Option::is_none")] pub domain: Option, - /// Operator dashboard root (`https:///`). + /// Operator dashboard root (`https:///`). #[serde(default, skip_serializing_if = "Option::is_none")] pub home: Option, /// Forge browser URL (`HIVE_FORGE_PUBLIC_URL`) — `None` when diff --git a/hivectl/src/wg.rs b/hivectl/src/wg.rs index b291a622..cf84f120 100644 --- a/hivectl/src/wg.rs +++ b/hivectl/src/wg.rs @@ -29,6 +29,9 @@ const HIVE_TLS_TRUST_BUNDLE_PATH: &str = "/var/lib/hive-tls/trust-bundle.pem"; /// *and future* hive validates. const STORE_PKI_ROOT_PATH: &str = "/var/lib/hive-tls/swarm-services-root.pem"; +/// The option whose value keys a hive's entry in `services.hyperhive.swarm.hives`. +const HIVE_NAME_OPTION: &str = "services.hyperhive.deploy.hive-controller.hiveName"; + /// Attrset key for a hive in `services.hyperhive.swarm.hives`, derived /// from its domain's first DNS label. /// @@ -177,6 +180,16 @@ fn wg_pubkey(privkey: &[u8]) -> Result { Ok(String::from_utf8_lossy(&out.stdout).trim().to_owned()) } +/// The closing comment of the `wg peer` snippet. +fn wg_peer_key_note() -> String { + format!(" # the key must be that hive's {HIVE_NAME_OPTION}") +} + +/// The first closing comment line of the `peer-config` snippet. +fn peer_config_key_note() -> String { + format!("# the key must be this hive's {HIVE_NAME_OPTION}, and the") +} + /// `wg peer` — print the nix snippet to add a peer hive to the mesh. /// Pure output (no fallible work), so it returns `()`; the dispatch arm /// wraps it in `Ok` to match the sibling verbs. @@ -193,7 +206,7 @@ pub(crate) fn wg_peer(domain: &str, pubkey: &str, address: &str, endpoint: Optio println!(" wireguardEndpoint = \"{ep}\";"); } println!(" }};"); - println!(" # the key must be that hive's services.hyperhive.hiveName"); + println!("{}", wg_peer_key_note()); } /// The `peer-config` step carrying the secret store's `pki` root: the @@ -248,7 +261,7 @@ pub(crate) fn peer_config(domain: &str, wg_address: Option<&str>, wg_endpoint: O println!(" wireguardEndpoint = \"{ep}\";"); } println!("}};"); - println!("# the key must be this hive's services.hyperhive.hiveName, and the"); + println!("{}", peer_config_key_note()); println!("# same entry belongs in every hive's config — `hives` is the swarm."); if !self_signed { println!( @@ -276,10 +289,26 @@ pub(crate) fn wg_status() -> Result<()> { #[cfg(test)] mod tests { - use super::{STORE_PKI_ROOT_PATH, store_root_step, write_key_0400}; + use super::{ + STORE_PKI_ROOT_PATH, peer_config_key_note, store_root_step, wg_peer_key_note, + write_key_0400, + }; const PEM: &str = "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----"; + /// Both snippets tell the operator to set the deploy option, never the + /// removed `services.hyperhive` spelling. + #[test] + fn key_notes_name_the_deploy_option() { + for note in [wg_peer_key_note(), peer_config_key_note()] { + assert!( + note.contains("services.hyperhive.deploy.hive-controller.hiveName"), + "{note}" + ); + assert!(!note.contains("services.hyperhive.hiveName"), "{note}"); + } + } + /// The certificate is printed whole, on lines of its own, so a peer /// operator can copy it out of the output as a PEM file. #[test] diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix index 1ad52b7b..67c79238 100644 --- a/nix/host-modules/deploy.nix +++ b/nix/host-modules/deploy.nix @@ -143,6 +143,12 @@ in # # The runner moved from `deploy.forgejo.ci` to `deploy.ci-runner` with # every option keeping its type and meaning, so the old paths forward. + # `hiveName` names the hive a host runs, so it moved under the service + # that runs one. Same type and meaning. + (lib.mkRenamedOptionModule + [ "services" "hyperhive" "hiveName" ] + [ "services" "hyperhive" "deploy" "hive-controller" "hiveName" ] + ) (lib.mkRenamedOptionModule [ "services" "hyperhive" "deploy" "forgejo" "ci" "enable" ] [ "services" "hyperhive" "deploy" "ci-runner" "enable" ] @@ -514,6 +520,39 @@ in ''; }; + hive-controller.hiveName = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + example = "pr1ma"; + description = '' + Name of the hive this host runs, and the key of its entry in + {option}`services.hyperhive.swarm.hives`. **Required** when + {option}`services.hyperhive.deploy.hive-controller.enable` is set; + a host that runs no hive needs none. + + Not merely a display name: the hive occupies + `.`, and the name is the hive's identity to + the swarm (its secret-store certificate subject, its OIDC client, its + status key). Distinct from {option}`services.hyperhive.domain`, the + machine-addressable DNS name. Exposed to agents as + `HYPERHIVE_HIVE_NAME`; surfaced in the dashboard chrome and per-agent + system prompt. The identity surfaces are listed in + `docs/process/conventions.md`, § Hive identity. + ''; + }; + + hive-controller.dashboardDomain = lib.mkOption { + type = lib.types.nullOr lib.types.str; + readOnly = true; + internal = true; + description = '' + Read-only: this hive's entry in + {option}`services.hyperhive.swarm.dashboardDomains`, or null where + `hiveName` has no entry in {option}`services.hyperhive.swarm.hives` + (asserted). + ''; + }; + swarm-controller.enable = lib.mkOption { type = lib.types.bool; default = false; diff --git a/nix/host-modules/glue-bao-readers-store-order.nix b/nix/host-modules/glue-bao-readers-store-order.nix index 4fad50d8..4fc9e438 100644 --- a/nix/host-modules/glue-bao-readers-store-order.nix +++ b/nix/host-modules/glue-bao-readers-store-order.nix @@ -32,7 +32,7 @@ let hiveOtelSecret = import ./lib/hive-otel-secret.nix { inherit (hyperhiveCfg.swarm.authelia) hiveClientPrefix; - inherit (hyperhiveCfg) hiveName; + inherit (hyperhiveCfg.deploy.hive-controller) hiveName; }; havePair = cert: key: cert != null && key != null; @@ -47,7 +47,7 @@ let # under the hive's own leaf. swarm-bao-hive-otel-oidc = otel.collector.enable - && hyperhiveCfg.hiveName != null + && hyperhiveCfg.deploy.hive-controller.hiveName != null && havePair baoDeploy.clientCertFile baoDeploy.clientKeyFile && otel.clientSecretFile == hiveOtelSecret.path; # ./swarm-grafana.nix diff --git a/nix/host-modules/glue-bao-tls.nix b/nix/host-modules/glue-bao-tls.nix index c9a88edf..71286f26 100644 --- a/nix/host-modules/glue-bao-tls.nix +++ b/nix/host-modules/glue-bao-tls.nix @@ -41,16 +41,18 @@ let # re-issuing every client certificate in the swarm. pkiDir = import ./lib/bao-pki-dir.nix; - # What a reader calls itself to the store. The hive's name, because a bao - # cert-auth role matches on the CN — this is an interface, not a label. - # No fallback: `hiveName` is asserted set wherever `deploy.bao.enable` is - # (./hyperhive.nix), the same condition this file's `config` is gated on. A - # fallback here reads as a second supported spelling and there is no such - # thing. - clientCn = hyperhiveCfg.hiveName; + # The hive this host runs, if any, and what it calls itself to the store: the + # hive's name, because a bao cert-auth role matches on the CN — this is an + # interface, not a label. `hiveName` is asserted set wherever + # `deploy.hive-controller.enable` is (./hyperhive.nix), and the reader leaf + # below exists only there: a store host that runs no hive has no hive to + # name, and a fallback CN would read as a second supported spelling. + runsHive = deployCfg.hive-controller.enable; + clientCn = hyperhiveCfg.deploy.hive-controller.hiveName; - # Every other hive in the swarm directory. This host's own hive is signed - # into the top of the directory, beside the leaves its units read. + # Every other hive in the swarm directory. This host's own hive, where there + # is one, is signed into the top of the directory, beside the leaves its + # units read. otherHives = lib.filter (h: h != clientCn) (lib.attrNames hyperhiveCfg.swarm.hives); # $1 dir $2 basename $3 CN $4 SAN or "" $5 EKU @@ -83,15 +85,16 @@ in serverCertFile = lib.mkDefault "${pkiDir}/server.pem"; serverKeyFile = lib.mkDefault "${pkiDir}/server-key.pem"; clientCaFile = lib.mkDefault "${pkiDir}/ca.pem"; - - # A reader on this host, which happens to be the host that mints. Only - # these three are what a reader elsewhere needs placed by hand; that they - # collapse to the same CA file here is a property of self-signing, not of - # the pairing. - clientCertFile = lib.mkDefault "${pkiDir}/client.pem"; - clientKeyFile = lib.mkDefault "${pkiDir}/client-key.pem"; serverCaFile = lib.mkDefault "${pkiDir}/ca.pem"; + # The hive's own reader on this host, which happens to be the host that + # mints. Only where a hive runs: the leaf's CN is the hive's name, and a + # store host without a hive has no reader to name. That the pair collapses + # to the same CA file as the server's here is a property of + # self-signing, not of the pairing. + clientCertFile = lib.mkIf runsHive (lib.mkDefault "${pkiDir}/client.pem"); + clientKeyFile = lib.mkIf runsHive (lib.mkDefault "${pkiDir}/client-key.pem"); + # 🩸 The readers below each present a leaf of their own rather than # `client.pem` above. The leaf is what bao sees, so this pairing is the # whole of what turns "one principal with the union of their grants" into @@ -181,8 +184,10 @@ in # CA is a file rather than a service. [ -s ${pkiDir}/server.pem ] || ${signLeaf} ${pkiDir} server \ ${lib.escapeShellArg cfg.domain} ${lib.escapeShellArg "DNS:${cfg.domain}"} serverAuth - [ -s ${pkiDir}/client.pem ] || ${signLeaf} ${pkiDir} client \ - ${lib.escapeShellArg clientCn} "" clientAuth + ${lib.optionalString runsHive '' + [ -s ${pkiDir}/client.pem ] || ${signLeaf} ${pkiDir} client \ + ${lib.escapeShellArg clientCn} "" clientAuth + ''} # Minted whether or not a controller runs here, because the case it # serves is the one where it does not: a controller elsewhere needs a @@ -329,7 +334,7 @@ in [ -s ${pkiDir}/forge-publisher.pem ] || ${signLeaf} ${pkiDir} forge-publisher \ ${lib.escapeShellArg deployCfg.bao.forgePublisherCommonName} "" clientAuth - ${lib.optionalString deployCfg.hive-controller.enable '' + ${lib.optionalString runsHive '' # This hive's gateway-leaf identity, which opens # `pki/issue/-` and nothing else. Its # subject carries this hive's name, because ./swarm-bao.nix writes diff --git a/nix/host-modules/glue-controller-bao-identity.nix b/nix/host-modules/glue-controller-bao-identity.nix index 86fba6d5..8a71d0ad 100644 --- a/nix/host-modules/glue-controller-bao-identity.nix +++ b/nix/host-modules/glue-controller-bao-identity.nix @@ -9,10 +9,10 @@ # second signer would duplicate that file's `openssl` helper to no benefit. # What belongs here is the pairing: which paths this host's controller reads. # -# ⚠️ Gated on the leaf existing, not on the store being enabled. A controller -# on the store's own host is one deployment; a controller three networks away -# holding a leaf issued out of band is another, and both want the same wiring. -# `deploy.bao.enable` would have made the first one the only supported shape. +# ⚠️ Gated on a PKI directory existing (the store runs here, or the operator +# named a reader leaf), not on the store alone. A controller on the store's own +# host is one deployment; a controller three networks away holding a leaf +# issued out of band is another, and both want the same wiring. # # Everything is `mkDefault`. An operator naming their own paths wins. { @@ -25,11 +25,18 @@ let deployCfg = hyperhiveCfg.deploy; baoDeploy = deployCfg.bao; - # Where ./glue-bao-tls.nix puts the leaves. Derived from the reader's own - # path rather than repeating that file's directory literal: an operator who - # moves the PKI moves both, and the two cannot drift apart. - haveMintedPki = baoDeploy.clientCertFile != null; - pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null; + # Where ./glue-bao-tls.nix puts the leaves. An operator's own `clientCertFile` + # names the directory when one is set (an operator who moves the PKI moves + # both, and the two cannot drift apart); on a store host that runs no hive + # there is no reader leaf to derive from, so it is the store's directory. + haveMintedPki = baoDeploy.clientCertFile != null || baoDeploy.enable; + pkiDir = + if baoDeploy.clientCertFile != null then + builtins.dirOf baoDeploy.clientCertFile + else if baoDeploy.enable then + import ./lib/bao-pki-dir.nix + else + null; in { config = lib.mkIf (deployCfg.swarm-controller.enable && haveMintedPki) { diff --git a/nix/host-modules/glue-hive-otel-authelia.nix b/nix/host-modules/glue-hive-otel-authelia.nix index 25c91af5..a581776f 100644 --- a/nix/host-modules/glue-hive-otel-authelia.nix +++ b/nix/host-modules/glue-hive-otel-authelia.nix @@ -23,13 +23,13 @@ let autheliaMachine = hyperhiveCfg.swarm.authelia.machine; # ./otel.nix: `senderAuth`, `hiveLeaf`, `fetches`, `fetchedSecretPath`. - senderAuth = otel.clientSecretFile != null && hyperhiveCfg.hiveName != null; + senderAuth = otel.clientSecretFile != null && hyperhiveCfg.deploy.hive-controller.hiveName != null; hiveLeaf = hyperhiveCfg.deploy.bao.clientCertFile != null && hyperhiveCfg.deploy.bao.clientKeyFile != null; fetchedSecretPath = (import ./lib/hive-otel-secret.nix { inherit (hyperhiveCfg.swarm.authelia) hiveClientPrefix; - inherit (hyperhiveCfg) hiveName; + inherit (hyperhiveCfg.deploy.hive-controller) hiveName; }).path; fetches = senderAuth && hiveLeaf && otel.clientSecretFile == fetchedSecretPath; waits = senderAuth && !fetches; diff --git a/nix/host-modules/glue-matrix-hive-discovery.nix b/nix/host-modules/glue-matrix-hive-discovery.nix index 1f33d4b6..abb4d71a 100644 --- a/nix/host-modules/glue-matrix-hive-discovery.nix +++ b/nix/host-modules/glue-matrix-hive-discovery.nix @@ -30,7 +30,7 @@ let matrixCfg.gatewayHost != null && hyperhiveCfg.deploy.hive-controller.enable && gatewayCfg.enable - && hyperhiveCfg.swarm.dashboardDomain != null; + && hyperhiveCfg.deploy.hive-controller.dashboardDomain != null; # Same default as `effectiveServerName` in ./hive-matrix.nix. serverName = diff --git a/nix/host-modules/glue-secret-publisher-bao-identity.nix b/nix/host-modules/glue-secret-publisher-bao-identity.nix index 742097f7..342f0639 100644 --- a/nix/host-modules/glue-secret-publisher-bao-identity.nix +++ b/nix/host-modules/glue-secret-publisher-bao-identity.nix @@ -9,7 +9,7 @@ # belongs here is the pairing: which host paths go to the publisher in # authelia's container. # -# ⚠️ Gated on the leaf existing, not on the store being enabled — the same rule +# ⚠️ Gated on a PKI directory existing, not on the store alone — the same rule # ./glue-controller-bao-identity.nix states. A publisher on the store's own # host is one deployment; a publisher beside a remote authelia holding a leaf # issued out of band is another, and both want this wiring. @@ -25,11 +25,18 @@ let deployCfg = hyperhiveCfg.deploy; baoDeploy = deployCfg.bao; - # Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own - # path rather than repeating that file's directory literal: an operator who - # moves the PKI moves both, and the two cannot drift apart. - haveMintedPki = baoDeploy.clientCertFile != null; - pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null; + # Where ./glue-bao-tls.nix puts the leaves. An operator's own `clientCertFile` + # names the directory when one is set (an operator who moves the PKI moves + # both, and the two cannot drift apart); on a store host that runs no hive + # there is no reader leaf to derive from, so it is the store's directory. + haveMintedPki = baoDeploy.clientCertFile != null || baoDeploy.enable; + pkiDir = + if baoDeploy.clientCertFile != null then + builtins.dirOf baoDeploy.clientCertFile + else if baoDeploy.enable then + import ./lib/bao-pki-dir.nix + else + null; in { config = lib.mkIf (deployCfg.swarm-secret-publisher.enable && haveMintedPki) { diff --git a/nix/host-modules/hive-c0re/environment.nix b/nix/host-modules/hive-c0re/environment.nix index ea5c7756..288e5286 100644 --- a/nix/host-modules/hive-c0re/environment.nix +++ b/nix/host-modules/hive-c0re/environment.nix @@ -49,13 +49,13 @@ in # required (asserted in hive-network.nix), so it's always set. HYPERHIVE_HIVE_DOMAIN = config.services.hyperhive.domain; } -// lib.optionalAttrs (config.services.hyperhive.swarm.dashboardDomain != null) { +// lib.optionalAttrs (config.services.hyperhive.deploy.hive-controller.dashboardDomain != null) { # The host the dashboard and the agent UIs answer on, for the URLs c0re # hands out (`hivectl open home`, each agent's UI link). - HYPERHIVE_DASHBOARD_DOMAIN = config.services.hyperhive.swarm.dashboardDomain; + HYPERHIVE_DASHBOARD_DOMAIN = config.services.hyperhive.deploy.hive-controller.dashboardDomain; } -// lib.optionalAttrs (config.services.hyperhive.hiveName != null) { - HYPERHIVE_HIVE_NAME = config.services.hyperhive.hiveName; +// lib.optionalAttrs (config.services.hyperhive.deploy.hive-controller.hiveName != null) { + HYPERHIVE_HIVE_NAME = config.services.hyperhive.deploy.hive-controller.hiveName; } // lib.optionalAttrs (config.services.hyperhive.swarm.name != null) { HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarm.name; @@ -221,7 +221,7 @@ in # The identity swarm-authelia.nix already declares for every entry in # `swarm.hives` — the hive does not choose its own name here, it uses # the one the roster gave it. - HIVE_C0RE_OIDC_CLIENT_ID = "hive-${config.services.hyperhive.hiveName}"; + HIVE_C0RE_OIDC_CLIENT_ID = "hive-${config.services.hyperhive.deploy.hive-controller.hiveName}"; } // # Where the agents reach the queue: the address goes into every container in diff --git a/nix/host-modules/hive-c0re/vhosts.nix b/nix/host-modules/hive-c0re/vhosts.nix index 860f2cac..2e877a9d 100644 --- a/nix/host-modules/hive-c0re/vhosts.nix +++ b/nix/host-modules/hive-c0re/vhosts.nix @@ -1,5 +1,5 @@ # The hive's gateway surface, declared under `services.hyperhive.gateway.vhosts` -# like every service's: the dashboard's vhost (`swarm.dashboardDomain`), which +# like every service's: the dashboard's vhost (`deploy.hive-controller.dashboardDomain`), which # carries the dashboard behind authelia, per-agent routing and the swagger UI; # and the vhost named for the hive domain, which redirects everything to the # dashboard's name. The matrix redirect, and discovery for a server name pinned to @@ -12,7 +12,7 @@ let hyperhiveCfg = config.services.hyperhive; gatewayCfg = hyperhiveCfg.gateway; - inherit (hyperhiveCfg.swarm) dashboardDomain; + inherit (hyperhiveCfg.deploy.hive-controller) dashboardDomain; autheliaDomain = hyperhiveCfg.swarm.authelia.domain; inherit (gatewayCfg.lib) errorPages; diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index d9caf905..647ea995 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -706,10 +706,8 @@ in # per-host flag is false exactly where this entry is needed. webhook.ALLOWED_HOST_LIST = lib.concatStringsSep "," ( lib.unique ( - [ - "external" - hyperhiveDomain - ] + [ "external" ] + ++ lib.optional (hyperhiveDomain != null) hyperhiveDomain ++ lib.optional (swarmDomain != null) swarmDomain ) ); diff --git a/nix/host-modules/hive-gateway/default.nix b/nix/host-modules/hive-gateway/default.nix index 4cfe0839..9f17f5f0 100644 --- a/nix/host-modules/hive-gateway/default.nix +++ b/nix/host-modules/hive-gateway/default.nix @@ -423,7 +423,7 @@ in # answer; a service added later lands here with no edit, and cannot # land here with a different condition than it used for DNS. networking.hosts = lib.mkIf cfg.localHostsEntry { - "127.0.0.1" = lib.unique ([ hyperhiveDomain ] ++ cfg.localNames); + "127.0.0.1" = lib.unique (lib.optional (hyperhiveDomain != null) hyperhiveDomain ++ cfg.localNames); }; }; } diff --git a/nix/host-modules/hive-gateway/dnsmasq.nix b/nix/host-modules/hive-gateway/dnsmasq.nix index e93b5498..10dda986 100644 --- a/nix/host-modules/hive-gateway/dnsmasq.nix +++ b/nix/host-modules/hive-gateway/dnsmasq.nix @@ -52,19 +52,18 @@ # Hive authoritative records — answer queries for the hive domain # + its sub-domains with the bridge IP, where nginx is reachable # from every container netns. - address = [ - "/${hyperhiveDomain}/${networkCfg.bridgeIp}" - ] - # Names contributed by the modules that own them - # (`gateway.localNames`). Same address as everything above — the - # bridge IP is the gateway's answer for anything it fronts, and a - # contributing module neither knows nor should know it. - # - # `unique` is not tidiness: two modules claiming one name would - # otherwise emit two `address=` rules for it, and dnsmasq resolves - # that by precedence rather than by complaining. An assertion in - # ./default.nix makes the collision loud instead. - ++ map (name: "/${name}/${networkCfg.bridgeIp}") (lib.unique cfg.localNames); + address = + lib.optional (hyperhiveDomain != null) "/${hyperhiveDomain}/${networkCfg.bridgeIp}" + # Names contributed by the modules that own them + # (`gateway.localNames`). Same address as everything above — the + # bridge IP is the gateway's answer for anything it fronts, and a + # contributing module neither knows nor should know it. + # + # `unique` is not tidiness: two modules claiming one name would + # otherwise emit two `address=` rules for it, and dnsmasq resolves + # that by precedence rather than by complaining. An assertion in + # ./default.nix makes the collision loud instead. + ++ map (name: "/${name}/${networkCfg.bridgeIp}") (lib.unique cfg.localNames); # DHCP pool covering all usable host addresses on the bridge # subnet — bounds computed by hive-network.nix from # bridgeIp/bridgePrefixLength. All containers (agents and service diff --git a/nix/host-modules/hive-gateway/options.nix b/nix/host-modules/hive-gateway/options.nix index a4a86831..4928dd84 100644 --- a/nix/host-modules/hive-gateway/options.nix +++ b/nix/host-modules/hive-gateway/options.nix @@ -13,7 +13,7 @@ in { imports = [ (lib.mkRemovedOptionModule [ "services" "hyperhive" "gateway" "auth" ] '' - The dashboard is served on services.hyperhive.swarm.dashboardDomain + The dashboard is served on services.hyperhive.deploy.hive-controller.dashboardDomain behind authelia, and only accounts in authelia's `admins` group can open it. There is no HTTP Basic auth and no htpasswd file. Remove the setting; add an operator with `swarmctl user add --group admins`. diff --git a/nix/host-modules/hive-matrix.nix b/nix/host-modules/hive-matrix.nix index 3adc511b..5c7951e4 100644 --- a/nix/host-modules/hive-matrix.nix +++ b/nix/host-modules/hive-matrix.nix @@ -9,6 +9,8 @@ let networkCfg = config.services.hyperhive.network; tlsCfg = config.services.hyperhive.deploy.hive-controller.tls; gatewayCfg = config.services.hyperhive.gateway; + # The hive's own domain; null on a homeserver host that runs no hive, where + # the client is pointed at the server name instead. hyperhiveDomain = config.services.hyperhive.domain; # Same runtime→build-time bridge hive-forge and swarm-ci-runner cross: @@ -491,11 +493,14 @@ in }; # FluffyChat boot-config pre-fill so the client's # `.well-known/matrix/client` lookup hits the right delegation - # endpoint. `domain` is required, so this is always present. + # endpoint. A hive host names its hive domain; a homeserver host + # without a hive has none and names the server name. "= /config.json" = { extraConfig = '' default_type application/json; - return 200 '{"defaultHomeserver":"${hyperhiveDomain}"}'; + return 200 '{"defaultHomeserver":"${ + if hyperhiveDomain != null then hyperhiveDomain else effectiveServerName + }"}'; ''; }; }; diff --git a/nix/host-modules/hive-network.nix b/nix/host-modules/hive-network.nix index 1d902020..a94c31c6 100644 --- a/nix/host-modules/hive-network.nix +++ b/nix/host-modules/hive-network.nix @@ -219,7 +219,7 @@ in which each hive occupies one sub-domain. A guessed value would be a wrong hostname that evaluates cleanly and deploys. Set it (`services.hyperhive.swarm.domain = "example.com";`) — with - `hiveName` it also derives `services.hyperhive.domain` for you. + `deploy.hive-controller.hiveName` it also derives `services.hyperhive.domain` for you. ''; } ]; diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix index 786d79da..e0eb2518 100644 --- a/nix/host-modules/hive-tls.nix +++ b/nix/host-modules/hive-tls.nix @@ -68,17 +68,20 @@ let # goes on the swarm-services leaf below, and asking this role for one is a # refusal. hiveLeafRole = - if hyperhiveCfg.hiveName == null then + if hyperhiveCfg.deploy.hive-controller.hiveName == null then null else - "${baoDeploy.hiveLeafPkiRolePrefix}-${hyperhiveCfg.hiveName}"; + "${baoDeploy.hiveLeafPkiRolePrefix}-${hyperhiveCfg.deploy.hive-controller.hiveName}"; # Everything after the first rides as a SAN. - hiveLeafNames = [ - domain - "*.${domain}" - ] - ++ lib.optional (hyperhiveCfg.swarm.dashboardDomain != null) hyperhiveCfg.swarm.dashboardDomain; + hiveLeafNames = + lib.optionals (domain != null) [ + domain + "*.${domain}" + ] + ++ lib.optional ( + hyperhiveCfg.deploy.hive-controller.dashboardDomain != null + ) hyperhiveCfg.deploy.hive-controller.dashboardDomain; showPath = p: if p == null then "unset" else p; @@ -522,7 +525,7 @@ in # even while its current leaf is still valid. ${ if hiveLeafRole == null then - ''fail "services.hyperhive.hiveName is unset, so this hive has no gateway-leaf role to issue from."'' + ''fail "services.hyperhive.deploy.hive-controller.hiveName is unset, so this hive has no gateway-leaf role to issue from."'' else requireHiveIdentity "ask the store for its gateway leaf" } diff --git a/nix/host-modules/hyperhive.nix b/nix/host-modules/hyperhive.nix index 44d682c6..79d39ceb 100644 --- a/nix/host-modules/hyperhive.nix +++ b/nix/host-modules/hyperhive.nix @@ -9,6 +9,7 @@ }: let hiveCfg = config.services.hyperhive; + hiveName = hiveCfg.deploy.hive-controller.hiveName; in { imports = [ @@ -46,8 +47,8 @@ in # would recreate the second path (and, since that default reads # `swarm.domain` too, a value that can differ from the directory's). default = - if hiveCfg.hiveName != null && hiveCfg.swarm.hives ? ${hiveCfg.hiveName} then - hiveCfg.swarm.hives.${hiveCfg.hiveName}.domain + if hiveName != null && hiveCfg.swarm.hives ? ${hiveName} then + hiveCfg.swarm.hives.${hiveName}.domain else null; defaultText = lib.literalExpression "services.hyperhive.swarm.hives.\${hiveName}.domain, or null when there is no entry for this hive"; @@ -90,7 +91,7 @@ in hive's address belongs in the swarm directory, which every hive in the swarm shares a copy of: - services.hyperhive.swarm.hives."${toString hiveCfg.hiveName}".domain = "${toString hiveCfg.domain}"; + services.hyperhive.swarm.hives."${toString hiveName}".domain = "${toString hiveCfg.domain}"; (Or drop the value entirely if it is the conventional `.` — that is the directory entry's own @@ -115,7 +116,7 @@ in occupies its own sub-domain of it, which is why every entry in `services.hyperhive.swarm.hives` defaults its `domain` to `.` — set this plus - `services.hyperhive.hiveName`, list the hives by name, and no + `services.hyperhive.deploy.hive-controller.hiveName`, list the hives by name, and no hive in the swarm states an address at all. **Required** on every host that runs a hyperhive service (a @@ -129,56 +130,69 @@ in ''; }; - # Human display name for this hive. Distinct from the DNS domain - # above (machine-readable) — see docs/process/conventions.md::Hive identity - # for the domain-vs-name-vs-swarm distinction + the env-var - # propagation chain. The swarm's display name is - # `services.hyperhive.swarm.name`, one level out: this hive is named - # here, the swarm it belongs to is named there. - options.services.hyperhive.hiveName = lib.mkOption { - type = lib.types.nullOr lib.types.str; - default = null; - example = "pr1ma"; - description = '' - Human-readable name of this single-host hive instance. - **Required** when this host runs a hive, the swarm's secret store - or its homeserver - (`services.hyperhive.deploy.hive-controller.enable`, - `deploy.bao.enable`, `deploy.matrix.enable`). Distinct from - `services.hyperhive.domain` (the machine-addressable DNS name) - and not merely cosmetic: a hive occupies - `.`, so this is the label the hive is - *addressed* by as well as the one it is called. Exposed to - agents as `HYPERHIVE_HIVE_NAME`; surfaced in the dashboard - chrome and per-agent system prompt. - ''; - }; - - # Each of these deployments turns `hiveName` into an identifier with no - # fallback: hive-c0re's OIDC client and matrix localpart, the CN of the - # store's `client.pem` (./glue-bao-tls.nix), and the `hives/` path - # the queue credential reader fetches. A null there renders - # as an empty string that evaluates and deploys. + # The hive's name is `deploy.hive-controller.hiveName`, declared in + # ./deploy.nix beside the switch that makes a host run a hive. The + # identity surfaces (label, domain, display names, env-var chain) are in + # docs/process/conventions.md::Hive identity. + # + # A hive turns the name into an identifier with no fallback: hive-c0re's + # OIDC client and matrix localpart, the CN of the hive's `client.pem` + # (./glue-bao-tls.nix), and the `hives/` path of its secrets. A null + # there renders as an empty string that evaluates and deploys. config.assertions = [ { - assertion = - !( - hiveCfg.deploy.hive-controller.enable || hiveCfg.deploy.bao.enable || hiveCfg.deploy.matrix.enable - ) - || hiveCfg.hiveName != null; + assertion = !hiveCfg.deploy.hive-controller.enable || hiveName != null; message = '' - hyperhive requires services.hyperhive.hiveName to be set on a host - that runs a hive, the swarm's secret store or its homeserver — it is - this hive's label within the swarm, and the leftmost part of the - domain it is addressed by (`.`), not only a - display name. Set it (`services.hyperhive.hiveName = "pr1ma";`). + hyperhive requires services.hyperhive.deploy.hive-controller.hiveName + to be set on a host that runs a hive — it is this hive's label + within the swarm, and the leftmost part of the domain it is + addressed by (`.`), not only a display name. + Set it (`services.hyperhive.deploy.hive-controller.hiveName = "pr1ma";`). + ''; + } + { + # An EMPTY `hives` fires this too, deliberately: since + # `swarm.domain` is required, every hive is in a swarm — a swarm of + # one is still a swarm — so a directory with no entry for this host + # is missing one either way. It also has to fire here, because this + # host's own domain is read out of the directory: without the entry + # `services.hyperhive.domain` is null and the generic required-domain + # assertion in ./hive-network.nix would fire instead, naming an + # option the operator should not be setting. + # + # Guarded on `hiveName != null` so the required-hiveName assertion + # above is what fires for that case — two assertions naming the same + # missing value is noise. + assertion = + !hiveCfg.deploy.hive-controller.enable || hiveName == null || hiveCfg.swarm.hives ? ${hiveName}; + message = '' + services.hyperhive.swarm.hives has no entry for this hive + (services.hyperhive.deploy.hive-controller.hiveName = "${toString hiveName}"). + + `hives` describes every hive in the swarm including this one, + so that every host can share one identical attrset, and this + hive's own domain is derived from its entry. Add: + + services.hyperhive.swarm.hives."${toString hiveName}" = { }; + + No fields are needed: `domain` defaults to + `.`. Set it in the entry if this hive is + addressed by something else. + + Declared hives: ${lib.concatStringsSep ", " (lib.attrNames hiveCfg.swarm.hives)} ''; } ]; + config.services.hyperhive.deploy.hive-controller.dashboardDomain = + if hiveName != null && hiveCfg.swarm.dashboardDomains ? ${hiveName} then + hiveCfg.swarm.dashboardDomains.${hiveName} + else + null; + # The one hive-level option that describes something ABOVE the hive, # which is why it sits under `swarm` with the swarm-global services - # rather than beside `hiveName`. + # rather than beside the hive's name. options.services.hyperhive.swarm.name = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; diff --git a/nix/host-modules/otel.nix b/nix/host-modules/otel.nix index b9a5f8a7..ddec8d59 100644 --- a/nix/host-modules/otel.nix +++ b/nix/host-modules/otel.nix @@ -48,7 +48,7 @@ let # Where `swarm-bao-hive-otel-oidc` lands the secret on this host. hiveOtelSecret = import ./lib/hive-otel-secret.nix { inherit (config.services.hyperhive.swarm.authelia) hiveClientPrefix; - inherit (config.services.hyperhive) hiveName; + inherit (config.services.hyperhive.deploy.hive-controller) hiveName; }; fetchedSecretPath = hiveOtelSecret.path; in @@ -190,7 +190,10 @@ in clientSecretFile = lib.mkOption { type = lib.types.nullOr lib.types.str; default = - if hiveLeaf && config.services.hyperhive.hiveName != null then fetchedSecretPath else null; + if hiveLeaf && config.services.hyperhive.deploy.hive-controller.hiveName != null then + fetchedSecretPath + else + null; defaultText = lib.literalExpression ''"/run/hive-otel-oidc/''${swarm.authelia.hiveClientPrefix}''${hiveName}.secret" when deploy.bao.clientCertFile and clientKeyFile are set, else null''; example = "/var/lib/secrets/hive-telemetry.secret"; description = '' @@ -256,7 +259,7 @@ in deployCfg = config.services.hyperhive.deploy; swarmOtelCfg = config.services.hyperhive.swarm.otel; hiveOtelCfg = config.services.hyperhive.swarm.hiveOtel; - hiveName = config.services.hyperhive.hiveName; + hiveName = config.services.hyperhive.deploy.hive-controller.hiveName; listen = "${config.services.hyperhive.network.bridgeIp}:${toString hiveOtelCfg.collectorPort}"; swarmName = "otlphttp/swarm"; gatewayCfg = config.services.hyperhive.gateway; @@ -884,7 +887,9 @@ in services.hyperhive.otel.clientSecretFile = ${ if otel.clientSecretFile == null then "null" else otel.clientSecretFile } - services.hyperhive.hiveName = ${if hiveName == null then "null" else hiveName} + services.hyperhive.deploy.hive-controller.hiveName = ${ + if hiveName == null then "null" else hiveName + } Every hive authenticates as itself — that is what makes the `hive` label on its metrics mean anything — so both are diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix index 95e39a63..f3a8240b 100644 --- a/nix/host-modules/swarm-bao.nix +++ b/nix/host-modules/swarm-bao.nix @@ -1310,9 +1310,10 @@ let # same class of surprise it exists to remove. baoCli = let - # The reader's identity `glue-bao-tls` already mints on this host, so - # cert-auth login needs nothing typed either. A token stays the - # operator's to supply — a wrapper cannot conjure one. + # The hive reader identity `glue-bao-tls` mints where a hive runs, so + # cert-auth login needs nothing typed either. A store host without a hive + # has no such identity and the operator supplies a token or a leaf; a + # wrapper cannot conjure either. wrapArgs = [ "--set-default BAO_ADDR ${lib.escapeShellArg "https://${cfg.domain}:${toString cfg.port}"}" ] diff --git a/nix/host-modules/swarm-ui.nix b/nix/host-modules/swarm-ui.nix index c275c53c..b693c60b 100644 --- a/nix/host-modules/swarm-ui.nix +++ b/nix/host-modules/swarm-ui.nix @@ -1,6 +1,6 @@ # The swarm-level web UI: a static bundle served by the gateway's nginx, # behind authelia. Distinct from the per-hive dashboard (hive-c0re's, on -# `swarm.dashboardDomain`) — this one answers for the swarm apex and is the +# `deploy.hive-controller.dashboardDomain`) — this one answers for the swarm apex and is the # operator's view across hives. # # Options, and the swarm apex's vhost, declared below through diff --git a/nix/host-modules/swarm-wireguard.nix b/nix/host-modules/swarm-wireguard.nix index 2df2b82a..68321c46 100644 --- a/nix/host-modules/swarm-wireguard.nix +++ b/nix/host-modules/swarm-wireguard.nix @@ -118,7 +118,7 @@ # our own entry would configure a tunnel to ourselves. meshPeers = lib.filterAttrs ( name: p: - name != config.services.hyperhive.hiveName + name != config.services.hyperhive.deploy.hive-controller.hiveName && p.wireguardPublicKey != null && p.wireguardAddress != null ) config.services.hyperhive.swarm.hives; diff --git a/nix/host-modules/swarm.nix b/nix/host-modules/swarm.nix index 175c3f63..1f15661b 100644 --- a/nix/host-modules/swarm.nix +++ b/nix/host-modules/swarm.nix @@ -1,6 +1,6 @@ # The swarm's directory: one entry per hive, **including this one**, -# identical on every host in the swarm. `services.hyperhive.hiveName` -# says which entry is us. +# identical on every host in the swarm. A host that runs a hive says which +# entry is its own with `services.hyperhive.deploy.hive-controller.hiveName`. # # Why a directory rather than a per-host peer list: every field here is # intrinsic to the hive it describes — none of them says anything about @@ -217,14 +217,14 @@ in Every hive in this swarm, keyed by `hiveName` — **including this host's own hive**. The same attrset is meant to be identical on every host in the swarm, so it can be written once and shared; - `services.hyperhive.hiveName` is what makes a given host read it + `services.hyperhive.deploy.hive-controller.hiveName` is what makes a hive host read it as "me and four others" rather than "five peers". Each entry needs no fields at all in the conventional case: a hive's `domain` defaults to `.`, so the whole directory is usually a list of names. - It must contain an entry for `hiveName`, which is asserted — this + On a host that runs a hive it must contain an entry for `hiveName`, which is asserted — this host's own address is read out of it (it is where `services.hyperhive.domain` derives from), and a hive that lists everyone but itself would otherwise derive its own peer set as @@ -247,16 +247,6 @@ in ''; }; - options.services.hyperhive.swarm.dashboardDomain = lib.mkOption { - type = lib.types.nullOr lib.types.str; - readOnly = true; - internal = true; - description = '' - Read-only: this hive's entry in `dashboardDomains`, or null where - `hiveName` has no entry in `hives` (asserted below). - ''; - }; - options.services.hyperhive.swarm.serviceDomains = lib.mkOption { type = lib.types.listOf lib.types.str; readOnly = true; @@ -284,49 +274,11 @@ in if swarmCfg.domain == null then "${name}.hives.invalid" else "${name}.hives.${swarmCfg.domain}" ) swarmCfg.hives; - services.hyperhive.swarm.dashboardDomain = - if cfg.hiveName != null && swarmCfg.dashboardDomains ? ${cfg.hiveName} then - swarmCfg.dashboardDomains.${cfg.hiveName} - else - null; - services.hyperhive.swarm.serviceDomains = lib.sort (a: b: a < b) ( lib.unique (lib.filter (d: d != null && d != "") serviceDomains') ); assertions = [ - { - # An EMPTY `hives` fires this too, deliberately: since - # `swarm.domain` is required, every hive is in a swarm — a - # swarm of one is still a swarm — so a directory with no entry - # for this host is missing one either way. It also has to fire - # here, because this host's own domain is now read out of the - # directory: without the entry `services.hyperhive.domain` is - # null and the generic required-domain assertion in - # ./hive-network.nix would fire instead, naming an option the - # operator should not be setting. - # - # Guarded on `hiveName != null` so the required-hiveName - # assertion in ./hyperhive.nix is what fires for that case — - # two assertions naming the same missing value is noise. - assertion = cfg.hiveName == null || swarmCfg.hives ? ${cfg.hiveName}; - message = '' - services.hyperhive.swarm.hives has no entry for this hive - (services.hyperhive.hiveName = "${toString cfg.hiveName}"). - - `hives` describes every hive in the swarm including this one, - so that every host can share one identical attrset, and this - hive's own domain is derived from its entry. Add: - - services.hyperhive.swarm.hives."${toString cfg.hiveName}" = { }; - - No fields are needed: `domain` defaults to - `.`. Set it in the entry if this hive is - addressed by something else. - - Declared hives: ${lib.concatStringsSep ", " (lib.attrNames swarmCfg.hives)} - ''; - } (nameGuards.mustBeIdent { option = "services.hyperhive.swarm.hives"; names = hiveNames; diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix index c13dab80..34cac809 100644 --- a/nix/module-eval/core-toggle.nix +++ b/nix/module-eval/core-toggle.nix @@ -568,7 +568,7 @@ let l = vh."h1.hives.t.local".locations; gated = loc: lib.hasInfix "auth_request /__hive_authelia;" loc.extraConfig; in - allLocal.services.hyperhive.swarm.dashboardDomain == "h1.hives.t.local" + allLocal.services.hyperhive.deploy.hive-controller.dashboardDomain == "h1.hives.t.local" && vh."h1.hives.t.local".forceSSL && lib.all (p: gated l.${p}) [ "/" @@ -1251,23 +1251,133 @@ let && bare.networking.bridges ? hive-br0; } { - # Refused wherever something turns the name into an identifier, and only - # there. The store host is the control that the refusal is not the hive's - # alone; the host running neither is the control that it is gated at all. - name = "a missing hiveName is refused on a hive and on a store host, not elsewhere"; + # Refused where a hive runs and nowhere else. A name is an identifier + # only for a hive; the hive host is the control that the lookup finds the + # refusal when there is one. + name = "a missing hiveName is refused on a hive and not on a store, homeserver or services host"; ok = let - refusedHiveName = + refused = extra: - lib.any (a: !a.assertion && lib.hasInfix "services.hyperhive.hiveName to be set" a.message) - (hiveWithController ({ hiveName = null; } // extra)).assertions; + lib.any ( + a: + !a.assertion + && lib.hasInfix "services.hyperhive.deploy.hive-controller.hiveName" a.message + && lib.hasInfix "to be set" a.message + ) (hive (lib.recursiveUpdate { deploy.hive-controller.hiveName = null; } extra)).assertions; in - refusedHiveName { } - && refusedHiveName { - deploy.hive-controller.enable = false; - deploy.bao.enable = true; - } - && !(refusedHiveName { deploy.hive-controller.enable = false; }); + refused { deploy.hive-controller.enable = true; } + && !(refused { deploy.bao.enable = true; }) + && !(refused { deploy.matrix.enable = true; }) + && !(refused { deploy.allSwarmServices = true; }); + } + { + # The directory entry is asserted for a hive and only for a hive. The + # hive host with a name the directory lacks is the control. + name = "a hive whose name has no swarm.hives entry is refused, and a host without a hive is not asked"; + ok = + let + noEntry = + extra: + lib.any (a: !a.assertion && lib.hasInfix "swarm.hives has no entry for this hive" a.message) + (hive (lib.recursiveUpdate { deploy.hive-controller.hiveName = "other"; } extra)).assertions; + in + noEntry { deploy.hive-controller.enable = true; } + && !(noEntry { deploy.bao.enable = true; }) + && !(noEntry { deploy.allSwarmServices = true; }); + } + { + # Nothing of the hive's identity is minted for a host that runs no hive: + # no reader leaf named after a hive, and no reader identity at all, so + # the glue that locates the PKI falls back to the store's own directory. + # The hive host with the same store is the control. + name = "a store host without a hive mints no hive reader leaf and still wires the controller and publisher"; + ok = + let + storeNoHive = hive { + deploy.hive-controller.hiveName = null; + deploy.bao.enable = true; + deploy.swarm-controller.enable = true; + deploy.swarm-secret-publisher.enable = true; + }; + storeWithHive = hiveWithController { + deploy.bao.enable = true; + deploy.swarm-controller.enable = true; + deploy.swarm-secret-publisher.enable = true; + }; + pki = m: m.systemd.services.swarm-bao-pki.script; + d = m: m.services.hyperhive.deploy; + in + (d storeNoHive).bao.clientCertFile == null + && (d storeNoHive).bao.clientKeyFile == null + && !(lib.hasInfix "/var/lib/swarm-bao-pki/client.pem ]" (pki storeNoHive)) + && (d storeNoHive).swarm-controller.baoClientCertFile == "/var/lib/swarm-bao-pki/controller.pem" + && + (d storeNoHive).swarm-secret-publisher.baoClientCertFile + == "/var/lib/swarm-bao-pki/secret-publisher.pem" + && (d storeWithHive).bao.clientCertFile == "/var/lib/swarm-bao-pki/client.pem" + && lib.hasInfix "/var/lib/swarm-bao-pki/client.pem ]" (pki storeWithHive) + && (d storeWithHive).swarm-controller.baoClientCertFile == "/var/lib/swarm-bao-pki/controller.pem"; + } + { + # An operator's own reader leaf names the PKI directory, exactly as it did + # when the glue always derived it from that path. + name = "a controller and publisher with an operator-placed reader leaf and no store follow its directory"; + ok = + let + m = hive { + deploy.swarm-controller.enable = true; + deploy.swarm-secret-publisher.enable = true; + deploy.bao.clientCertFile = "/etc/pki/elsewhere/client.pem"; + deploy.bao.clientKeyFile = "/etc/pki/elsewhere/client-key.pem"; + }; + d = m.services.hyperhive.deploy; + in + !d.bao.enable + && d.swarm-controller.baoClientCertFile == "/etc/pki/elsewhere/controller.pem" + && d.swarm-secret-publisher.baoClientCertFile == "/etc/pki/elsewhere/secret-publisher.pem"; + } + { + # The old spelling forwards with the module system's one warning and + # produces the same hive. The new-path host is the control that the + # warning is not always present. + name = "services.hyperhive.hiveName still sets the hive's name, with a rename warning"; + ok = + let + old = hiveWithController { + hiveName = "legacy"; + swarm.hives.legacy = { }; + }; + warned = + m: + lib.any ( + w: lib.hasInfix "services.hyperhive.hiveName" w && lib.hasInfix "has been renamed" w + ) m.warnings; + in + old.services.hyperhive.deploy.hive-controller.hiveName == "legacy" + && old.systemd.services.hive-c0re.environment.HYPERHIVE_HIVE_NAME == "legacy" + && warned old + && !(warned bare); + } + { + # A hive's rendered identity, pinned so moving the option changes none of + # it: the coordinator's name and client, the dashboard name, the CN of the + # reader leaf the store host signs, and what the hive collector presents. + name = "a hive's name reaches hive-c0re, the reader leaf, the dashboard and the hive collector unchanged"; + ok = + let + e = allLocal.systemd.services.hive-c0re.environment; + script = allLocal.systemd.services.swarm-bao-pki.script; + lines = lib.splitString "\n" script; + at = lib.lists.findFirstIndex (lib.hasSuffix "swarm-bao-pki client \\") null lines; + nextLine = builtins.head (builtins.match " *(.*)" (builtins.elemAt lines (at + 1))); + in + e.HYPERHIVE_HIVE_NAME == "h1" + && e.HIVE_C0RE_OIDC_CLIENT_ID == "hive-h1" + && e.HYPERHIVE_DASHBOARD_DOMAIN == "h1.hives.t.local" + && allLocal.services.hyperhive.deploy.hive-controller.dashboardDomain == "h1.hives.t.local" + && at != null + && nextLine == ''h1 "" clientAuth''; } { # The control is a host that defines no such option; the removal message diff --git a/nix/module-eval/hive-otel.nix b/nix/module-eval/hive-otel.nix index 875fe7c9..c858da87 100644 --- a/nix/module-eval/hive-otel.nix +++ b/nix/module-eval/hive-otel.nix @@ -391,6 +391,19 @@ let && !(builtins.elem container (wait baoWithHiveOtel).after) && !(builtins.elem container (wait baoWithHiveOtel).requires); } + { + # What the hive collector presents and where it presents it, both derived + # from the hive's name: pinned so the name's option path can move without + # the collector's identity changing. + name = "the hive collector authenticates as hive- and pushes to the swarm collector under the name's path"; + ok = + let + otel = hiveOtel.services.hyperhive.swarm.otel; + in + hiveOtelSettings.extensions."oauth2client/swarm".client_id == "hive-h1" + && hiveOtelSettings.extensions."oauth2client/swarm".endpoint_params.audience == "hive-h1" + && hiveOtelSettings.exporters."otlphttp/swarm".endpoint == "https://${otel.domain}/h1"; + } ]; in runGroup "hive-otel" cases diff --git a/nix/module-eval/lib.nix b/nix/module-eval/lib.nix index be481dca..5205e2f8 100644 --- a/nix/module-eval/lib.nix +++ b/nix/module-eval/lib.nix @@ -65,7 +65,7 @@ let # just one level down. `recursiveUpdate` merges nested attrsets # all the way down instead. services.hyperhive = lib.recursiveUpdate { - hiveName = "h1"; + deploy.hive-controller.hiveName = lib.mkDefault "h1"; swarm.domain = "t.local"; swarm.hives.h1.domain = "h1.t.local"; } extra;