vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-gateway: keep matrix discovery on the hive domain of a homeserver host without a hive

Browse source 
The hive-domain vhost renders where a hive or the homeserver runs. Its
matrix .well-known JSON and /matrix/ redirect are served wherever the
homeserver runs; the dashboard, swagger UI, agent routes and the
agents.conf include only where a hive runs, since they proxy to hive-c0re.

The gateway doc's vhost map says which rows exist without a hive, and the
trust-bundle text describes ca.pem by what it is rather than as retired.

Refs #4588
This commit is contained in:
atlas 2026-10-04 17:58:16 +02:00 • committed by mara
commit 3e1ac4e678
5 changed files with 91 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

51
nix/host-modules/hive-gateway/vhosts.nix
View file

@ -248,31 +248,34 @@ in
'';
};
}
// lib.optionalAttrs runsHive {
# The hive's own surface, reachable by NAME. Named rather than left
# to `_`, so the catch-all can reject everything else. Only where a
# hive runs: it proxies to hive-c0re, which runs only with the hive
# controller.
// lib.optionalAttrs (runsHive || matrixDeployCfg.enable) {
# The hive domain's own vhost, reachable by NAME, so the catch-all can
# reject everything else. It exists where it has something to serve:
# matrix discovery and the `/matrix/` redirect where the homeserver runs
# here, and the dashboard, agent routes and swagger UI where a hive runs
# (they proxy to hive-c0re, which runs only with the hive controller).
${hyperhiveDomain} = (vhostTlsFor hyperhiveDomain) // {
listen = vhostListen;
locations =
matrixRedirectLocations
// wellKnownLocations
// agentLocations
// dashboardProxyLocation
// swaggerUiLocations
// lib.optionalAttrs cfg.auth.enable {
# Internal-only target for the 401 error_page above.
# `internal` prevents direct client access; `alias` serves
# the pre-built HTML from the Nix store.
"= /__hive_auth_unauthorized" = {
extraConfig = ''
internal;
alias ${errorPages.unauthorized};
default_type text/html;
'';
};
};
// lib.optionalAttrs runsHive (
agentLocations
// dashboardProxyLocation
// swaggerUiLocations
// lib.optionalAttrs cfg.auth.enable {
# Internal-only target for the dashboard's 401 error_page.
# `internal` prevents direct client access; `alias` serves
# the pre-built HTML from the Nix store.
"= /__hive_auth_unauthorized" = {
extraConfig = ''
internal;
alias ${errorPages.unauthorized};
default_type text/html;
'';
};
}
);
# Per-agent location blocks, generated at runtime by
# hive-c0re and written to /var/lib/hive-gateway/conf/agents.conf
# on the host — the same machine nginx runs on. nginx parses
@ -281,9 +284,11 @@ in
# agents without a nixos-rebuild. nginx's longest-prefix-
# match rule ensures `/agent/<name>/` from this file beats
# the `/agent/` catch-all above.
extraConfig = securityHeaders + ''
include /var/lib/hive-gateway/conf/agents.conf;
'';
extraConfig =
securityHeaders
+ lib.optionalString runsHive ''
include /var/lib/hive-gateway/conf/agents.conf;
'';
};
};
}

19
nix/host-modules/hive-tls.nix
View file

@ -251,9 +251,8 @@ in
# generates or signs with a CA key. See
# `docs/networking/gateway.md` ("Self-signed TLS") and docs/swarm/ca.md.
#
# The trust bundle still carries the retired hive CA's public `ca.pem`
# where one exists, so a leaf it signed keeps verifying until it is
# replaced.
# The trust bundle also carries a hive CA's public `ca.pem` where one
# exists, so a leaf it signed verifies until it is replaced.
options.services.hyperhive.deploy.hive-controller.tls = {
stateDir = lib.mkOption {
@ -264,9 +263,9 @@ in
self-signed gateway mode: `gateway.pem` / `gateway-key.pem` (the
leaf the store issues and nginx serves) and `trust-bundle.pem` (the
anchors agents and federation peers trust). `ca.pem` and
`ca-previous.pem`, where present, are the retired hive CA's public
certificates and stay in the bundle. A `ca-key.pem` an earlier
generation left is neither read nor removed.
`ca-previous.pem`, where present, are a hive CA's public
certificates and stay in the bundle. A `ca-key.pem` here is neither
read nor removed.
'';
};
@ -421,8 +420,8 @@ in
#
# `swarm-services-root.pem` is the store's `pki` root, which both
# the gateway leaf and the swarm-services leaf chain to. `ca.pem`
# and `ca-previous.pem` are the retired hive CA's public
# certificates, kept so a leaf they signed verifies until replaced.
# and `ca-previous.pem` are a hive CA's public certificates, kept
# so a leaf they signed verifies until replaced.
bundle="$d/trust-bundle.pem"
anchors=()
if [ -s "$ca" ]; then anchors+=("$ca"); fi
@ -528,8 +527,8 @@ in
{ [ -s "$leaf" ] && [ -s "$leafk" ]; } || reissue=1
openssl x509 -in "$leaf" -noout -checkend "$renewat" >/dev/null 2>&1 || reissue=1
leavesCoverNames || reissue=1
# A leaf the retired hive CA signed, or one under a store root since
# replaced, fails this and is re-issued.
# A leaf that does not chain to the store's current root, whoever
# signed it, fails this and is re-issued.
{ [ -s "$svcroot" ] && openssl verify -CAfile "$svcroot" "$leaf" >/dev/null 2>&1; } || reissue=1
# The leaf and the key are two renames, so an interrupted rotation can
# leave a certificate beside a key it does not belong to.

39
nix/module-eval/swarm-services-switch.nix
View file

@ -45,6 +45,13 @@ let
deploy.bao.enable = true;
};
# The homeserver on a host without a hive: its hive-domain vhost serves
# matrix discovery and nothing of the hive's.
matrixNoHive = hive {
deploy.hive-controller.enable = false;
deploy.matrix.enable = true;
};
# The same switch with every service it owns placed elsewhere, so the only
# thing that can enable the gateway/resolver/bridge here is that toggle's
# own module — each service module asserts them from its own `enable`.
@ -232,7 +239,25 @@ let
in
!(lib.any (t: lib.any (r: lib.hasInfix r t) hiveLeafRefs) texts)
&& m.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile == null
&& !(m.services.nginx.virtualHosts ? "h1.t.local");
&& noHiveSurface m;
# The hive-domain vhost, where it renders at all, carries nothing
# that proxies to hive-c0re.
noHiveSurface =
m:
let
vh = m.services.nginx.virtualHosts;
v = vh."h1.t.local";
in
!(vh ? "h1.t.local")
|| (
!(lib.any (l: v.locations ? ${l}) [
"/"
"/api/"
"/agent/"
"/api/docs/"
])
&& !(lib.hasInfix "agents.conf" (v.extraConfig or ""))
);
noHive =
m:
let
@ -277,13 +302,23 @@ let
store.services.hyperhive.swarm.localServiceDomains
== [ store.services.hyperhive.swarm.bao.ui.domain ]
&& !(waitsForLeaf store)
# The homeserver without a hive: the hive-domain vhost serves matrix
# discovery and the redirect, and no hive surface.
&& noHive matrixNoHive
&& (
let
l = matrixNoHive.services.nginx.virtualHosts."h1.t.local".locations;
in
l ? "= /.well-known/matrix/client" && l ? "= /.well-known/matrix/server"
)
&& !(store.services.nginx.virtualHosts ? "h1.t.local")
&& lib.hasInfix "want_svc=1" store.systemd.services.swarm-services-cert.script
# Control: a hive host with the same services keeps the hive leaf,
# its unit and identity, and the hive-domain vhost.
&& hs ? hive-tls-resign
&& lib.hasInfix "install -m 0644 /var/lib/hive-tls/gateway.pem /var/lib/hive-gateway/tls/cert.pem" hs.hive-gateway-self-signed-cert.script
&& swarmServicesHere.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile != null
&& swarmServicesHere.services.nginx.virtualHosts ? "h1.t.local"
&& swarmServicesHere.services.nginx.virtualHosts."h1.t.local".locations ? "/api/"
&& !(noHiveLeafAnywhere swarmServicesHere);
}
{