chore: scrub #NNN issue references from code comments and nix descriptions
Part of the docs-migration chore (issue #708). Remove GitHub issue numbers from inline comments, option descriptions, and rustdoc — these are contextless noise for anyone reading the code without access to the original discussions. Replace with prose that captures the same rationale directly. No functional change. Build still clean (cargo check passes).
This commit is contained in:
iris
parent
083a100ba1
commit
188f3ea5ec
18 changed files with 131 additions and 151 deletions
|
|
@ -75,7 +75,7 @@ in
|
|||
canonical readable identity. Exposed to agents as
|
||||
`HYPERHIVE_HIVE_NAME`; surfaced in the dashboard chrome and
|
||||
per-agent system prompt when set. Null falls back to the
|
||||
pre-#701 behaviour (chrome shows the domain, prompt doesn't
|
||||
default behaviour (chrome shows the domain, prompt doesn't
|
||||
mention a hive name).
|
||||
'';
|
||||
};
|
||||
|
|
@ -141,7 +141,7 @@ in
|
|||
description = ''
|
||||
hyperhive workspace package. Provides `/bin/hive-c0re`
|
||||
(coordinator daemon + admin-socket CLI) and `/bin/hivectl`
|
||||
(operator-facing host CLI for ad-hoc administration; #655).
|
||||
(operator-facing host CLI for ad-hoc administration).
|
||||
'';
|
||||
};
|
||||
frontend = lib.mkOption {
|
||||
|
|
|
|||
|
|
@ -10,8 +10,7 @@ let
|
|||
hyperhiveDomain = config.services.hyperhive.domain;
|
||||
|
||||
# ROOT_URL forgejo advertises in clone links + outbound URLs. When
|
||||
# served behind the gateway (#749 — mara verdict at issue:9609,
|
||||
# sub-domain over sub-path), `cfg.domain` doubles as both the
|
||||
# served behind the gateway, `cfg.domain` doubles as both the
|
||||
# forgejo `DOMAIN` setting AND the gateway vhost server-name, so
|
||||
# ROOT_URL just uses it directly (drops the port suffix when the
|
||||
# gateway is on the canonical port 80). When direct (gateway off
|
||||
|
|
@ -83,18 +82,16 @@ in
|
|||
Public hostname for the forge. Doubles as both the forgejo
|
||||
`DOMAIN` setting (clone URLs forgejo advertises) AND the
|
||||
gateway vhost server-name when `behindGateway = true`
|
||||
(#749, mara verdict at issue:9609 — sub-domain over sub-path).
|
||||
(sub-domain routing — see `docs/gateway.md`).
|
||||
|
||||
Defaults to `forge.''${services.hyperhive.domain}` when the
|
||||
hive-domain is set (idiomatic sub-domain shape — `forge`
|
||||
labelled under the hive's bare domain), falling back to
|
||||
`localhost` otherwise (pre-#749 direct-on-port behaviour).
|
||||
`localhost` otherwise (direct-on-port behaviour).
|
||||
|
||||
Set to a full hostname (`git.example.com`,
|
||||
`forge.internal.lan`, etc.) for a bespoke vhost shape — the
|
||||
full domain goes here, no separate sub-domain-label option
|
||||
(mara on #754:9684 — "specify full forge domain in options
|
||||
instead").
|
||||
full domain goes here, no separate sub-domain-label option.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -120,8 +117,7 @@ in
|
|||
description = ''
|
||||
Serve forgejo through the hive-gateway nginx as a sub-domain
|
||||
vhost (`server_name = cfg.domain`) instead of directly on
|
||||
`httpPort` (#749, mara verdict at issue:9609 — sub-domain
|
||||
over sub-path).
|
||||
`httpPort` (sub-domain routing — see `docs/gateway.md`).
|
||||
|
||||
When `true`:
|
||||
- The gateway adds a `server { server_name = ''${cfg.domain}; }`
|
||||
|
|
@ -137,11 +133,10 @@ in
|
|||
gateway is running (e.g. an external git client that doesn't
|
||||
traverse the gateway).
|
||||
|
||||
The mara-call on #749:9609 picks sub-domain over sub-path for
|
||||
forge + matrix (both are external standard apps with sub-domain-
|
||||
native config defaults). Per-agent UIs stay on sub-path
|
||||
(`/agent/<name>/`) because they're hyperhive-internal +
|
||||
already base-path-aware via #731.
|
||||
Sub-domain routing is the preferred shape for forge + matrix
|
||||
(both are external standard apps with sub-domain-native config
|
||||
defaults). Per-agent UIs stay on sub-path (`/agent/<name>/`)
|
||||
because they're hyperhive-internal + already base-path-aware.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -171,18 +166,18 @@ in
|
|||
example = true;
|
||||
description = ''
|
||||
Open `httpPort` + `sshPort` in the host firewall. Off by
|
||||
default (#651, secure-by-default): the forge is reachable
|
||||
from the host + every agent container via `localhost` either
|
||||
way (shared netns), so the firewall opens only matter for
|
||||
access from outside the host. Flip to `true` when you want
|
||||
the operator's browser / external git clients to hit the
|
||||
forge directly. (The container shares host netns, so this
|
||||
is the only firewall layer that matters.)
|
||||
default (secure-by-default): the forge is reachable from the
|
||||
host + every agent container via `localhost` either way
|
||||
(shared netns), so the firewall opens only matter for access
|
||||
from outside the host. Flip to `true` when you want the
|
||||
operator's browser / external git clients to hit the forge
|
||||
directly. (The container shares host netns, so this is the
|
||||
only firewall layer that matters.)
|
||||
|
||||
**Breaking change as of #651**: this used to default to
|
||||
`true`. If you relied on the old default for external
|
||||
reach, add `services.hyperhive.forge.openFirewall = true;`
|
||||
to your host config before rebuilding.
|
||||
**Breaking change**: this used to default to `true`. If you
|
||||
relied on the old default for external reach, add
|
||||
`services.hyperhive.forge.openFirewall = true;` to your host
|
||||
config before rebuilding.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -117,20 +117,19 @@ in
|
|||
(`@argus:<server_name>`) and room ID minted on this
|
||||
homeserver. CRITICAL: must be stable from day one because
|
||||
it's embedded irrevocably in the identifiers. Defaults to
|
||||
`services.hyperhive.domain` (the bare hive domain — per mara
|
||||
on #660). Combined with the `.well-known/matrix/{client,server}`
|
||||
routes the hive-gateway serves at that domain (also #660),
|
||||
clients auto-discover the actual matrix endpoint without
|
||||
needing a subdomain. Override here only if you need a
|
||||
different server_name shape (e.g. `matrix.<domain>` if you
|
||||
want the subdomain split, or `chat.example.org` for a
|
||||
bespoke hostname).
|
||||
`services.hyperhive.domain` (the bare hive domain). Combined
|
||||
with the `.well-known/matrix/{client,server}` routes the
|
||||
hive-gateway serves at that domain, clients auto-discover the
|
||||
actual matrix endpoint without needing a subdomain. Override
|
||||
here only if you need a different server_name shape (e.g.
|
||||
`matrix.<domain>` if you want the subdomain split, or
|
||||
`chat.example.org` for a bespoke hostname).
|
||||
|
||||
**Breaking change as of #660**: this used to default to
|
||||
**Breaking change**: this used to default to
|
||||
`matrix.''${services.hyperhive.domain}`. matrix IDs embed
|
||||
the server_name irrevocably, so existing homeservers must
|
||||
set `services.hyperhive.matrix.serverName = "matrix.''${services.hyperhive.domain}";`
|
||||
explicitly to preserve their pre-#660 user / room IDs
|
||||
explicitly to preserve their existing user / room IDs
|
||||
before rebuilding.
|
||||
'';
|
||||
};
|
||||
|
|
@ -160,15 +159,15 @@ in
|
|||
description = ''
|
||||
Public hostname for the matrix homeserver behind the gateway.
|
||||
Defaults to `matrix.''${services.hyperhive.domain}` (sub-domain
|
||||
shape per mara on #749:9609). Set to `null` to skip the gateway
|
||||
vhost (tuwunel stays direct on `httpPort`). See
|
||||
shape — see `docs/gateway.md`). Set to `null` to skip the
|
||||
gateway vhost (tuwunel stays direct on `httpPort`). See
|
||||
`docs/gateway.md` for the vhost map + matrix discovery flow,
|
||||
and the federation port-8448 caveat at the bottom of that doc.
|
||||
|
||||
Note: `gatewayHost` is the API listener hostname (where nginx
|
||||
proxies `/_matrix/*`); `serverName` is the matrix-identifier
|
||||
domain embedded irrevocably in user/room IDs (per #660
|
||||
default = bare hive-domain). The two are distinct.
|
||||
domain embedded irrevocably in user/room IDs (default = bare
|
||||
hive-domain). The two are distinct.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -177,18 +176,18 @@ in
|
|||
default = false;
|
||||
example = true;
|
||||
description = ''
|
||||
Open `httpPort` in the host firewall. Off by default (#651,
|
||||
secure-by-default): the homeserver is reachable from the
|
||||
Open `httpPort` in the host firewall. Off by default
|
||||
(secure-by-default): the homeserver is reachable from the
|
||||
host + every agent container via `localhost` either way
|
||||
(shared netns), so the firewall open only matters for
|
||||
access from outside the host. Flip to `true` when announcing
|
||||
the homeserver to other hives or when an external matrix
|
||||
client needs to reach the client-server API directly.
|
||||
(shared netns), so the firewall open only matters for access
|
||||
from outside the host. Flip to `true` when announcing the
|
||||
homeserver to other hives or when an external matrix client
|
||||
needs to reach the client-server API directly.
|
||||
|
||||
**Breaking change as of #651**: this used to default to
|
||||
`true`. If you relied on the old default for external reach,
|
||||
add `services.hyperhive.matrix.openFirewall = true;` to
|
||||
your host config before rebuilding.
|
||||
**Breaking change**: this used to default to `true`. If you
|
||||
relied on the old default for external reach, add
|
||||
`services.hyperhive.matrix.openFirewall = true;` to your host
|
||||
config before rebuilding.
|
||||
|
||||
Note: federation (the matrix-spec well-known port 8448) is
|
||||
intentionally not opened here. tuwunel serves the federation
|
||||
|
|
@ -260,8 +259,8 @@ in
|
|||
type = lib.types.package;
|
||||
default = fluffychat-web-fixed;
|
||||
defaultText = lib.literalMD ''
|
||||
`pkgs.fluffychat-web` + #685 `postInstall` patch (adds the
|
||||
three files `flutter341.buildFlutterApplication` skips).
|
||||
`pkgs.fluffychat-web` with a `postInstall` patch that adds
|
||||
the three files `flutter341.buildFlutterApplication` skips.
|
||||
'';
|
||||
description = ''
|
||||
Static web client dist served at `matrix.<hive>/`. Override
|
||||
|
|
@ -275,9 +274,9 @@ in
|
|||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
# serverName must exist (mara on #548 — irrevocably embedded in
|
||||
# user/room IDs); gatewayHost may not be "" (argus 🟡 on #764 —
|
||||
# same footgun as forge.domain). docs/matrix.md::Assertion
|
||||
# serverName must exist (irrevocably embedded in user/room IDs);
|
||||
# gatewayHost may not be "" (same footgun as forge.domain —
|
||||
# nginx rejects an empty server_name). docs/matrix.md::Assertion
|
||||
# rationale.
|
||||
assertions = [
|
||||
{
|
||||
|
|
@ -307,9 +306,9 @@ in
|
|||
}
|
||||
];
|
||||
|
||||
# Activation-time token generation (argus #565: the bind-mount
|
||||
# would otherwise hand tuwunel an empty file on first boot and
|
||||
# break every registration until restart). Idempotent;
|
||||
# Activation-time token generation — without this the bind-mount
|
||||
# would hand tuwunel an empty file on first boot and break every
|
||||
# registration until restart. Idempotent;
|
||||
# docs/matrix.md::Provisioning flow.
|
||||
system.activationScripts.hive-matrix-register-token = lib.stringAfter [ "var" ] ''
|
||||
tokenFile=${lib.escapeShellArg (toString cfg.registrationTokenFile)}
|
||||
|
|
@ -358,13 +357,13 @@ in
|
|||
# LoadCredential below copies the host file into a
|
||||
# 0400 dynamic-user-owned path; tuwunel reads from there.
|
||||
registration_token_file = "/run/credentials/tuwunel.service/registration_token";
|
||||
# E2EE disabled in initial rollout (#548); re-enable at #551.
|
||||
# E2EE disabled in initial rollout; tracked in the issue tracker.
|
||||
allow_encryption = false;
|
||||
};
|
||||
};
|
||||
# Keeps DynamicUser=true + PrivateUsers=true intact — no
|
||||
# host-side chown :tuwunel / GID-pin gymnastics needed (#644 /
|
||||
# iris on 8043). See `man systemd.exec` → LoadCredential.
|
||||
# host-side chown :tuwunel / GID-pin gymnastics needed.
|
||||
# See `man systemd.exec` → LoadCredential.
|
||||
systemd.services.tuwunel.serviceConfig.LoadCredential = [
|
||||
"registration_token:${toString cfg.registrationTokenFile}"
|
||||
];
|
||||
|
|
|
|||
Loading…
Reference in a new issue