vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

service urls carry no gateway port, httpsPort is listen-only

Browse source
This commit is contained in:
atlas 2026-10-25 02:00:20 +02:00 • committed by mara
commit 19680a8b78
25 changed files with 105 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/module-eval/core-toggle.nix
View file

@ -64,12 +64,12 @@ let
otel.debug = true;
};
# The controller behind a gateway on a non-default TLS port: the only
# fixture whose collector URL carries a port. Only the controller's
# environment is read off it.
# The controller behind a gateway on a non-default TLS port, with the
# firewall opened. Its collector URL and its listener are read off it.
controllerAltPort = hive {
deploy.swarm-controller.enable = true;
gateway.httpsPort = 8443;
gateway.openFirewall = true;
};
# On the store's host, which mints the runner's store identity.
@ -167,6 +167,27 @@ let
name = "the all-local mode turns the swarm controller on";
ok = allLocal.services.hyperhive.deploy.swarm-controller.enable;
}
{
# `gateway.httpsPort` is a listen setting: the nginx TLS listener and the
# opened firewall port follow it, while a service URL built on the same
# host stays `https://<domain>`. The listener and firewall arms are the
# control that the port took effect on this fixture, so the URL arm
# cannot pass on a fixture where it was never set.
name = "a non-default gateway TLS port moves the listener and firewall, not the service URLs";
ok =
let
otel = controllerAltPort.services.hyperhive.swarm.otel;
listen = controllerAltPort.services.nginx.virtualHosts."_".listen;
tcp = controllerAltPort.networking.firewall.allowedTCPPorts;
url =
controllerAltPort.systemd.services.swarm-controller.environment.OTEL_EXPORTER_OTLP_ENDPOINT or null;
in
lib.any (l: l.port == 8443 && (l.ssl or false)) listen
&& !(lib.any (l: l.port == 443) listen)
&& lib.elem 8443 tcp
&& !(lib.elem 443 tcp)
&& url == "https://${otel.domain}/${otel.producerName}";
}
{
# ../host-modules/glue-controller-env.nix: the controller always exports to
# the swarm's collector. `controllerAlone` runs no collector of its own
@ -195,9 +216,6 @@ let
(env shared.controllerAlone).OTEL_EXPORTER_OTLP_ENDPOINT or null
== "https://${otel.domain}/${otel.producerName}"
&& (env shared.controllerAlone).SWARM_CONTROLLER_OTEL_AUDIENCE or null == clientId
&&
(env controllerAltPort).OTEL_EXPORTER_OTLP_ENDPOINT or null
== "https://${otel.domain}:8443/${otel.producerName}"
&& !(centralToggleOff.systemd.services ? swarm-controller);
}
{

20
nix/module-eval/forge-placement.nix
View file

@ -34,17 +34,21 @@ let
# The shared services here, the forge somewhere else. Every derivation in
# ../host-modules/swarm-required-services.nix is `mkDefault`, so this stays
# expressible — and it is also the authelia-without-forge host the OIDC
# client case needs.
# client case needs. Its gateway listens on a non-default TLS port, which no
# URL it renders may carry.
servicesForgeElsewhere = hive {
deploy.allSwarmServices = true;
deploy.forgejo.enable = false;
gateway.httpsPort = 8443;
};
# The forge with neither authelia nor the store, its store identity placed by
# hand: the other half of the split, and the deployment the store fetch
# exists for.
# exists for. Its gateway listens on a non-default TLS port, which the
# forge's own URL may not carry.
forgeAlone = hive {
deploy.forgejo.enable = true;
gateway.httpsPort = 8443;
deploy.bao.forgePublisherClientCertFile = "/etc/pki/forge-publisher.pem";
deploy.bao.forgePublisherClientKeyFile = "/etc/pki/forge-publisher-key.pem";
};
@ -166,6 +170,18 @@ let
servicesForgeElsewhere.services.hyperhive.swarm.forge.sso.redirectUri
== "https://forge.t.local/user/oauth2/authelia/callback";
}
{
# The gateway's TLS port is a listen setting. The first clause is the
# control that the fixture's gateway is on 8443, so the URL arms cannot
# pass on a fixture where it was never set.
name = "the forge's URLs carry no port when the gateway listens on a non-default one";
ok =
forgeAlone.services.hyperhive.gateway.httpsPort == 8443
&&
forgeAlone.containers.hive-forge.config.services.forgejo.settings.server.ROOT_URL
== "https://forge.t.local/"
&& servicesForgeElsewhere.services.hyperhive.gateway.httpsPort == 8443;
}
{
# The runner reaches the forge by name and reads its token with its own
# certificate, so nothing about the host it runs on is asked.

7
nix/module-eval/matrix-core.nix
View file

@ -132,14 +132,17 @@ let
# The discovery locations reach the hive domain's vhost from a glue
# module, merged into the vhost hive-c0re declares. The matrix-elsewhere
# arm reads the same vhost, which still exists there with its redirect,
# so its absence of discovery cannot pass on a misspelled name.
# so its absence of discovery cannot pass on a misspelled name. The
# fixture's gateway is on a non-default TLS port, which none of the URLs
# carry.
name = "matrix discovery sits on the hive domain's vhost only where the homeserver runs";
ok =
let
here = matrixNoBaoIdentity.services.nginx.virtualHosts."h1.t.local".locations;
elsewhere = matrixElsewhere.services.nginx.virtualHosts."h1.t.local".locations;
in
lib.hasInfix ''{"m.homeserver":{"base_url":"https://chat.t.local"}}'' (
matrixNoBaoIdentity.services.hyperhive.gateway.httpsPort == 8443
&& lib.hasInfix ''{"m.homeserver":{"base_url":"https://chat.t.local"}}'' (
here."= /.well-known/matrix/client".extraConfig or ""
)
&& lib.hasInfix ''{"m.server":"chat.t.local:443"}'' (

7
nix/module-eval/shared.nix
View file

@ -82,7 +82,12 @@ in
controllerAlone = hive { deploy.swarm-controller.enable = true; };
matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };
# On a non-default gateway TLS port, so the URLs it renders (discovery, the
# hive-domain redirect) show whether they follow it.
matrixNoBaoIdentity = hiveWithController {
deploy.matrix.enable = true;
gateway.httpsPort = 8443;
};
baoWithMatrix = hiveWithController {
deploy.bao.enable = true;