From 3b24d08226e40d09738bb2f4c11a48ecb583e805 Mon Sep 17 00:00:00 2001 From: iris Date: Sat, 15 Aug 2026 12:18:59 +0200 Subject: [PATCH] docs(swarm): fix stale four-wiring-sites table, verified against hive-gateway modules --- docs/swarm/ui.md | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/docs/swarm/ui.md b/docs/swarm/ui.md index 0bb73bcc..4835d0d5 100644 --- a/docs/swarm/ui.md +++ b/docs/swarm/ui.md @@ -61,17 +61,25 @@ not a hole: **reachability is not the access control here.** An agent that resolves the name and connects still has no operator session, and the subrequest denies it. -## Four wiring sites +## Two wiring sites -Adding a swarm service name means touching all four. Missing one ships as -a different flavour of "works from the host, broken from a container": +Adding a swarm service name means touching two things. Missing the +second ships as a different flavour of "works from the host, broken from +a container": | site | file | | --- | --- | -| vhost | `nix/host-modules/hive-gateway/vhosts.nix` | +| vhost + `gateway.localNames` | the service's own module (e.g. `nix/host-modules/swarm-ui.nix`) | | **certificate name** | `nix/host-modules/swarm.nix` (`serviceDomains`) | -| DNS record | `nix/host-modules/hive-gateway/dnsmasq.nix` | -| local-dev hosts | `nix/host-modules/hive-gateway/default.nix` | + +The DNS record and the local-dev `/etc/hosts` entry need no separate +edit: both are derived from `services.hyperhive.gateway.localNames`, +which a service's own module already has to push its domain into to be +resolvable — see `nix/host-modules/hive-gateway/dnsmasq.nix` and +`.../default.nix`'s `networking.hosts`. `vhosts.nix` itself is scoped to +the surface the hive's own domain serves (dashboard, per-agent routing, +matrix discovery); a swarm service declares its own vhost next to its +own options, the way `swarm-ui.nix` and `swarm-authelia.nix` do. ⚠️ The certificate one is the least obvious and the most visible when missed. `serviceDomains` is *both* the services sub-CA's