fix(#2860): no loopback default for the matrix homeserver
Third and last of #2860's agent-facing URL fallbacks. The operator's ruling was "any special casing is done on the nix side - same binaries, no hard coded fallback", so the default is deleted rather than replaced. Every layer guessed the same wrong thing, and each guess was only ever correct for a process sharing the host netns: - nix/agent-modules/matrix.nix: matrixUrlDefault = localhost:8008, both as the option's default and as a sentinel the daemon unit compared against to decide whether to write HIVE_MATRIX_URL. Now nullOr str, default null, the guard is != null, and the doc says what forge.url's already says: null means "no matrix", not "guess one". - nix/host-modules/hive-c0re/environment.nix: forwarded http://127.0.0.1:<port> when no gatewayHost was set. hive-c0re shares the host netns so it reads as harmless, but the value is handed to agents, which do not -- there it names the agent itself. Now forwarded only when there is a gateway vhost to name, matching the guard HIVE_MATRIX_PUBLIC_URL already uses twelve lines below. - hive-matrix-mcp: paths::DEFAULT_HOMESERVER was the same address compiled in, so dropping the nix defaults alone would have left the daemon dialling loopback inside the agent's own netns -- the very bug, one layer down. homeserver_url() is now Option, and an account with no homeserver is skipped with a log, exactly as one with no token is. discover_token_accounts already refused to guess for the same reason. Two comments taught the assumption back to the next reader ("shared host netns means every agent container resolves localhost to the same machine"); both now say which side of the netns boundary they describe. MATRIX_HTTP keeps its value -- hive-c0re really does share the host netns -- but no longer claims agents do. Gated with nix eval against the extended agent-base config, as a pair: with no url set the daemon unit carries no HIVE_MATRIX_URL, and with one set it carries exactly that. Either check alone passes on a broken guard.
This commit is contained in:
atlas
mara
parent
40cc115a0a
commit
0e9b1c563d
7 changed files with 109 additions and 70 deletions
|
|
@ -11,12 +11,6 @@
|
|||
}:
|
||||
let
|
||||
userName = config.hyperhive.user.name;
|
||||
# Single source of truth for the default matrix homeserver URL, shared
|
||||
# by the `hyperhive.matrix.url` option default and the daemon-unit guard
|
||||
# that decides whether to set a unit-level HIVE_MATRIX_URL (so the two
|
||||
# cannot drift). Matches the daemon's own built-in default
|
||||
# (`paths::DEFAULT_HOMESERVER`).
|
||||
matrixUrlDefault = "http://localhost:8008";
|
||||
# Rasterize the operator-set agent icon (`hyperhive.icon`, an SVG) to a
|
||||
# 512x512 PNG so the matrix daemon can upload it as each account's avatar
|
||||
# over the live authenticated Client (see hive-matrix-mcp::client::sync_avatar).
|
||||
|
|
@ -36,13 +30,13 @@ in
|
|||
When true (the default), the harness:
|
||||
|
||||
- runs `hive-matrix-daemon` as a systemd unit that holds a
|
||||
matrix-sdk Client + sync against the homeserver at
|
||||
`HIVE_MATRIX_URL` (default `http://localhost:8008` — the
|
||||
in-host tuwunel from `nix/host-modules/hive-matrix.nix`). The
|
||||
daemon auto-skips when `<state>/matrix-token` is missing,
|
||||
and a `systemd.paths` watcher restarts it the moment
|
||||
hive-c0re provisions the token (same path-trigger shape
|
||||
as `forge-avatar-sync`).
|
||||
matrix-sdk Client + sync against the homeserver named by
|
||||
`HIVE_MATRIX_URL` (see `hyperhive.matrix.url` — there is no
|
||||
default, since an agent's own netns makes a loopback guess
|
||||
wrong). The daemon auto-skips when that URL or
|
||||
`<state>/matrix-token` is missing, and a `systemd.paths`
|
||||
watcher restarts it the moment hive-c0re provisions the token
|
||||
(same path-trigger shape as `forge-avatar-sync`).
|
||||
- exposes the matrix tool surface (send_message, send_dm,
|
||||
send_reaction, send_reply, mark_read, list_rooms,
|
||||
list_room_members, read_room) to claude via an auto-injected
|
||||
|
|
@ -63,17 +57,27 @@ in
|
|||
};
|
||||
|
||||
options.hyperhive.matrix.url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = matrixUrlDefault;
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
example = "https://matrix.darkest.space";
|
||||
description = ''
|
||||
Matrix homeserver URL the agent's `hive-matrix-daemon` connects
|
||||
to. At runtime hive-c0re forwards the isolation-aware URL
|
||||
(`matrix.<domain>` via the gateway) so isolated agents reach
|
||||
the homeserver without crossing host loopback. Override
|
||||
per-agent when an agent should talk to an external homeserver
|
||||
instead (e.g. a federation-only setup or a remote hive's
|
||||
tuwunel reached via a vpn).
|
||||
to. hive-c0re writes this per agent from the hive's own
|
||||
isolation-aware URL (`matrix.<domain>` via the gateway), so a
|
||||
generated agent config always carries a real value; set it by
|
||||
hand only when an agent should talk to an external homeserver
|
||||
instead (a federation-only setup, or a remote hive's tuwunel
|
||||
reached over a vpn).
|
||||
|
||||
**`null` means "no matrix", not "guess one".** There is
|
||||
deliberately no loopback default: the homeserver may run on a
|
||||
different host from the agents, and inside an agent's network
|
||||
namespace `localhost` reaches the agent rather than the
|
||||
homeserver, so a default would be a value that builds fine and
|
||||
then talks to the wrong machine. When this is `null` the daemon
|
||||
is left without a homeserver and no-ops, exactly as it does when
|
||||
the token file is absent --- an absent integration, never a
|
||||
misdirected one.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -240,15 +244,15 @@ in
|
|||
HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
|
||||
RUST_LOG = "info";
|
||||
}
|
||||
# Homeserver URL: by default the daemon inherits the host-forwarded
|
||||
# HIVE_MATRIX_URL (set by hive-c0re to `matrix.<domain>` via the
|
||||
# gateway, since agents run in private netns and can't reach host
|
||||
# loopback directly), falling back to the daemon's built-in
|
||||
# localhost default if the forward is absent. A per-agent
|
||||
# `hyperhive.matrix.url` override (non-default) is set unit-level
|
||||
# so it wins over the forwarded value; at the default we
|
||||
# deliberately DON'T set it so the forwarded value isn't shadowed.
|
||||
// lib.optionalAttrs (config.hyperhive.matrix.url != matrixUrlDefault) {
|
||||
# Homeserver URL. hive-c0re writes this option per agent from the
|
||||
# hive's own `matrix.<domain>` gateway URL (agents run in a private
|
||||
# netns and cannot reach host loopback), so on a real hive it is
|
||||
# always set; `null` is the honest "this agent has no homeserver"
|
||||
# and leaves the daemon without one, which it treats like a missing
|
||||
# token and no-ops. Nothing here falls back to loopback: that would
|
||||
# be a value that evaluates fine and then addresses the agent's own
|
||||
# netns instead of the homeserver.
|
||||
// lib.optionalAttrs (config.hyperhive.matrix.url != null) {
|
||||
HIVE_MATRIX_URL = config.hyperhive.matrix.url;
|
||||
}
|
||||
# Multi-account: serialize the *extra* accounts to the JSON the
|
||||
|
|
|
|||
|
|
@ -100,19 +100,25 @@ in
|
|||
# gated on hyperhive being enabled). See `docs/gateway.md::HIVE_FORGE_URL`.
|
||||
HIVE_FORGE_URL = "http://${config.services.hyperhive.forge.domain}";
|
||||
}
|
||||
// lib.optionalAttrs config.services.hyperhive.matrix.enable {
|
||||
# In-cluster matrix homeserver URL for each agent's
|
||||
# hive-matrix-daemon — the gateway vhost (`matrix.<domain>`). The
|
||||
# gatewayHost null-guard falls back to loopback so a domain-less
|
||||
# config still evals. Forwarded to agents by meta.rs alongside
|
||||
# HIVE_FORGE_URL; shares the same env-forwarding ordering caveat
|
||||
# (value baked at config-generation time).
|
||||
HIVE_MATRIX_URL =
|
||||
if config.services.hyperhive.matrix.gatewayHost != null then
|
||||
"http://${config.services.hyperhive.matrix.gatewayHost}"
|
||||
else
|
||||
"http://127.0.0.1:${toString config.services.hyperhive.matrix.httpPort}";
|
||||
}
|
||||
//
|
||||
lib.optionalAttrs
|
||||
(config.services.hyperhive.matrix.enable && config.services.hyperhive.matrix.gatewayHost != null)
|
||||
{
|
||||
# In-cluster matrix homeserver URL for each agent's
|
||||
# hive-matrix-daemon — the gateway vhost (`matrix.<domain>`).
|
||||
# Forwarded to agents by meta.rs alongside HIVE_FORGE_URL; shares the
|
||||
# same env-forwarding ordering caveat (value baked at
|
||||
# config-generation time).
|
||||
#
|
||||
# A domain-less config forwards nothing rather than falling back to
|
||||
# loopback. The old fallback read as harmless because hive-c0re shares
|
||||
# the host netns — but the value it produced was handed to *agents*,
|
||||
# which do not, so `127.0.0.1` there names the agent itself. An absent
|
||||
# forward leaves `hyperhive.matrix.url` null and the daemon no-ops;
|
||||
# that is the honest answer when the hive has no matrix vhost to point
|
||||
# at.
|
||||
HIVE_MATRIX_URL = "http://${config.services.hyperhive.matrix.gatewayHost}";
|
||||
}
|
||||
// lib.optionalAttrs config.services.hyperhive.matrix.gui.enable {
|
||||
# Availability flags read by the dashboard's `/api/state`.
|
||||
# Matrix GUI lives entirely on the gateway nginx (matrix tab
|
||||
|
|
|
|||
Loading…
Reference in a new issue