vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

service urls carry no gateway port, httpsPort is listen-only

Browse source
This commit is contained in:
atlas 2026-10-25 02:00:20 +02:00 • committed by mara
commit 19680a8b78
25 changed files with 105 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/module-eval/forge-placement.nix
View file

@ -34,17 +34,21 @@ let
# The shared services here, the forge somewhere else. Every derivation in
# ../host-modules/swarm-required-services.nix is `mkDefault`, so this stays
# expressible — and it is also the authelia-without-forge host the OIDC
# client case needs.
# client case needs. Its gateway listens on a non-default TLS port, which no
# URL it renders may carry.
servicesForgeElsewhere = hive {
deploy.allSwarmServices = true;
deploy.forgejo.enable = false;
gateway.httpsPort = 8443;
};
# The forge with neither authelia nor the store, its store identity placed by
# hand: the other half of the split, and the deployment the store fetch
# exists for.
# exists for. Its gateway listens on a non-default TLS port, which the
# forge's own URL may not carry.
forgeAlone = hive {
deploy.forgejo.enable = true;
gateway.httpsPort = 8443;
deploy.bao.forgePublisherClientCertFile = "/etc/pki/forge-publisher.pem";
deploy.bao.forgePublisherClientKeyFile = "/etc/pki/forge-publisher-key.pem";
};
@ -166,6 +170,18 @@ let
servicesForgeElsewhere.services.hyperhive.swarm.forge.sso.redirectUri
== "https://forge.t.local/user/oauth2/authelia/callback";
}
{
# The gateway's TLS port is a listen setting. The first clause is the
# control that the fixture's gateway is on 8443, so the URL arms cannot
# pass on a fixture where it was never set.
name = "the forge's URLs carry no port when the gateway listens on a non-default one";
ok =
forgeAlone.services.hyperhive.gateway.httpsPort == 8443
&&
forgeAlone.containers.hive-forge.config.services.forgejo.settings.server.ROOT_URL
== "https://forge.t.local/"
&& servicesForgeElsewhere.services.hyperhive.gateway.httpsPort == 8443;
}
{
# The runner reaches the forge by name and reads its token with its own
# certificate, so nothing about the host it runs on is asked.