vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(swarm): fix stale four-wiring-sites table, verified against hive-gateway modules

Browse source
This commit is contained in:
iris 2026-08-15 12:18:59 +02:00 • committed by mara
commit 3b24d08226
1 changed files with 14 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/swarm/ui.md
View file

@ -61,17 +61,25 @@ not a hole: **reachability is not the access control here.** An agent
that resolves the name and connects still has no operator session, and that resolves the name and connects still has no operator session, and
the subrequest denies it. the subrequest denies it.
## Four wiring sites ## Two wiring sites
Adding a swarm service name means touching all four. Missing one ships as Adding a swarm service name means touching two things. Missing the
a different flavour of "works from the host, broken from a container": second ships as a different flavour of "works from the host, broken from
a container":
| site | file | | site | file |
| --- | --- | | --- | --- |
| vhost | `nix/host-modules/hive-gateway/vhosts.nix` | | vhost + `gateway.localNames` | the service's own module (e.g. `nix/host-modules/swarm-ui.nix`) |
| **certificate name** | `nix/host-modules/swarm.nix` (`serviceDomains`) | | **certificate name** | `nix/host-modules/swarm.nix` (`serviceDomains`) |
| DNS record | `nix/host-modules/hive-gateway/dnsmasq.nix` |
| local-dev hosts | `nix/host-modules/hive-gateway/default.nix` | The DNS record and the local-dev `/etc/hosts` entry need no separate
edit: both are derived from `services.hyperhive.gateway.localNames`,
which a service's own module already has to push its domain into to be
resolvable — see `nix/host-modules/hive-gateway/dnsmasq.nix` and
`.../default.nix`'s `networking.hosts`. `vhosts.nix` itself is scoped to
the surface the hive's own domain serves (dashboard, per-agent routing,
matrix discovery); a swarm service declares its own vhost next to its
own options, the way `swarm-ui.nix` and `swarm-authelia.nix` do.
⚠️ The certificate one is the least obvious and the most visible when ⚠️ The certificate one is the least obvious and the most visible when
missed. `serviceDomains` is *both* the services sub-CA's missed. `serviceDomains` is *both* the services sub-CA's