vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

nix(gateway): self-signed TLS as the implicit default, deprecate the toggle

Browse source 
Make self-signed TLS the gateway's default whenever no external TLS source
is configured, and deprecate the explicit selfSignedTls toggle. Self-signed
is now derived as `tls.certDir == null && !tls.acme.enable`, so an operator
selects a TLS mode by setting tls.certDir or tls.acme — or neither, for the
self-signed default. There is no http-only mode: matrix discovery hardcodes
https, so the gateway always terminates TLS.

The selfSignedTls option is kept as a deprecated no-op (warns when set to
false) so existing configs still eval. The two selfSignedTls mutual-
exclusion assertions and the HSTS-requires-TLS assertion are dropped — they
are impossible or vacuous now that self-signed is the floor. The hive-tls
module and the forge ROOT_URL scheme consume the derived value: the gateway
always terminates TLS, so behind the gateway the forge is always advertised
over https.

Updates docs/gateway.md (TLS-modes table, self-signed section, the removed
http-only section, firewall + discovery notes). Eval-proven: default →
self-signed (hive CA active, https ROOT_URL); tls.certDir → CA inactive;
selfSignedTls=false → deprecation warning fires.
This commit is contained in:
atlas 2026-06-17 20:26:03 +02:00 • committed by mara
commit 1a3f82a459
4 changed files with 112 additions and 109 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/modules/hive-tls.nix
View file

@ -12,11 +12,12 @@ let
# The host-managed hive CA is the trust anchor for self-signed mode.
# It is only stood up when the gateway actually serves a self-signed
# cert: a domain must be set (the leaf SANs derive from it) and
# `gateway.selfSignedTls` must be on. With an operator-supplied
# `tls.certDir` or ACME the public/operator CA already validates, so
# the hive CA is unnecessary.
active = hyperhiveCfg.enable && gatewayCfg.selfSignedTls && domain != null;
# cert: a domain must be set (the leaf SANs derive from it) and the
# gateway must be in self-signed mode — i.e. neither an operator cert
# (`tls.certDir`) nor ACME is configured. With either of those the
# public/operator CA already validates, so the hive CA is unnecessary.
useSelfSigned = gatewayCfg.tls.certDir == null && !gatewayCfg.tls.acme.enable;
active = hyperhiveCfg.enable && useSelfSigned && domain != null;
in
{
# Host-side TLS trust root for the self-signed gateway mode.