vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

chore: scrub #NNN issue references from code comments and nix descriptions

Browse source 
Part of the docs-migration chore (issue #708). Remove GitHub issue
numbers from inline comments, option descriptions, and rustdoc —
these are contextless noise for anyone reading the code without
access to the original discussions. Replace with prose that captures
the same rationale directly.

No functional change. Build still clean (cargo check passes).
This commit is contained in:
iris 2026-06-01 09:25:20 +02:00
commit 188f3ea5ec
18 changed files with 131 additions and 151 deletions
Download patch file Download diff file Expand all files Collapse all files

69
nix/modules/hive-matrix.nix
View file

@ -117,20 +117,19 @@ in
(`@argus:<server_name>`) and room ID minted on this
homeserver. CRITICAL: must be stable from day one because
it's embedded irrevocably in the identifiers. Defaults to
`services.hyperhive.domain` (the bare hive domain — per mara
on #660). Combined with the `.well-known/matrix/{client,server}`
routes the hive-gateway serves at that domain (also #660),
clients auto-discover the actual matrix endpoint without
needing a subdomain. Override here only if you need a
different server_name shape (e.g. `matrix.<domain>` if you
want the subdomain split, or `chat.example.org` for a
bespoke hostname).
`services.hyperhive.domain` (the bare hive domain). Combined
with the `.well-known/matrix/{client,server}` routes the
hive-gateway serves at that domain, clients auto-discover the
actual matrix endpoint without needing a subdomain. Override
here only if you need a different server_name shape (e.g.
`matrix.<domain>` if you want the subdomain split, or
`chat.example.org` for a bespoke hostname).
**Breaking change as of #660**: this used to default to
**Breaking change**: this used to default to
`matrix.''${services.hyperhive.domain}`. matrix IDs embed
the server_name irrevocably, so existing homeservers must
set `services.hyperhive.matrix.serverName = "matrix.''${services.hyperhive.domain}";`
explicitly to preserve their pre-#660 user / room IDs
explicitly to preserve their existing user / room IDs
before rebuilding.
'';
};
@ -160,15 +159,15 @@ in
description = ''
Public hostname for the matrix homeserver behind the gateway.
Defaults to `matrix.''${services.hyperhive.domain}` (sub-domain
shape per mara on #749:9609). Set to `null` to skip the gateway
vhost (tuwunel stays direct on `httpPort`). See
shape — see `docs/gateway.md`). Set to `null` to skip the
gateway vhost (tuwunel stays direct on `httpPort`). See
`docs/gateway.md` for the vhost map + matrix discovery flow,
and the federation port-8448 caveat at the bottom of that doc.
Note: `gatewayHost` is the API listener hostname (where nginx
proxies `/_matrix/*`); `serverName` is the matrix-identifier
domain embedded irrevocably in user/room IDs (per #660
default = bare hive-domain). The two are distinct.
domain embedded irrevocably in user/room IDs (default = bare
hive-domain). The two are distinct.
'';
};
@ -177,18 +176,18 @@ in
default = false;
example = true;
description = ''
Open `httpPort` in the host firewall. Off by default (#651,
secure-by-default): the homeserver is reachable from the
Open `httpPort` in the host firewall. Off by default
(secure-by-default): the homeserver is reachable from the
host + every agent container via `localhost` either way
(shared netns), so the firewall open only matters for
access from outside the host. Flip to `true` when announcing
the homeserver to other hives or when an external matrix
client needs to reach the client-server API directly.
(shared netns), so the firewall open only matters for access
from outside the host. Flip to `true` when announcing the
homeserver to other hives or when an external matrix client
needs to reach the client-server API directly.
**Breaking change as of #651**: this used to default to
`true`. If you relied on the old default for external reach,
add `services.hyperhive.matrix.openFirewall = true;` to
your host config before rebuilding.
**Breaking change**: this used to default to `true`. If you
relied on the old default for external reach, add
`services.hyperhive.matrix.openFirewall = true;` to your host
config before rebuilding.
Note: federation (the matrix-spec well-known port 8448) is
intentionally not opened here. tuwunel serves the federation
@ -260,8 +259,8 @@ in
type = lib.types.package;
default = fluffychat-web-fixed;
defaultText = lib.literalMD ''
`pkgs.fluffychat-web` + #685 `postInstall` patch (adds the
three files `flutter341.buildFlutterApplication` skips).
`pkgs.fluffychat-web` with a `postInstall` patch that adds
the three files `flutter341.buildFlutterApplication` skips.
'';
description = ''
Static web client dist served at `matrix.<hive>/`. Override
@ -275,9 +274,9 @@ in
};
config = lib.mkIf cfg.enable {
# serverName must exist (mara on #548 — irrevocably embedded in
# user/room IDs); gatewayHost may not be "" (argus 🟡 on #764 —
# same footgun as forge.domain). docs/matrix.md::Assertion
# serverName must exist (irrevocably embedded in user/room IDs);
# gatewayHost may not be "" (same footgun as forge.domain —
# nginx rejects an empty server_name). docs/matrix.md::Assertion
# rationale.
assertions = [
{
@ -307,9 +306,9 @@ in
}
];
# Activation-time token generation (argus #565: the bind-mount
# would otherwise hand tuwunel an empty file on first boot and
# break every registration until restart). Idempotent;
# Activation-time token generation — without this the bind-mount
# would hand tuwunel an empty file on first boot and break every
# registration until restart. Idempotent;
# docs/matrix.md::Provisioning flow.
system.activationScripts.hive-matrix-register-token = lib.stringAfter [ "var" ] ''
tokenFile=${lib.escapeShellArg (toString cfg.registrationTokenFile)}
@ -358,13 +357,13 @@ in
# LoadCredential below copies the host file into a
# 0400 dynamic-user-owned path; tuwunel reads from there.
registration_token_file = "/run/credentials/tuwunel.service/registration_token";
# E2EE disabled in initial rollout (#548); re-enable at #551.
# E2EE disabled in initial rollout; tracked in the issue tracker.
allow_encryption = false;
};
};
# Keeps DynamicUser=true + PrivateUsers=true intact — no
# host-side chown :tuwunel / GID-pin gymnastics needed (#644 /
# iris on 8043). See `man systemd.exec` → LoadCredential.
# host-side chown :tuwunel / GID-pin gymnastics needed.
# See `man systemd.exec` → LoadCredential.
systemd.services.tuwunel.serviceConfig.LoadCredential = [
"registration_token:${toString cfg.registrationTokenFile}"
];