vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-gateway: keep matrix discovery on the hive domain of a homeserver host without a hive

Browse source 
The hive-domain vhost renders where a hive or the homeserver runs. Its
matrix .well-known JSON and /matrix/ redirect are served wherever the
homeserver runs; the dashboard, swagger UI, agent routes and the
agents.conf include only where a hive runs, since they proxy to hive-c0re.

The gateway doc's vhost map says which rows exist without a hive, and the
trust-bundle text describes ca.pem by what it is rather than as retired.

Refs #4588
This commit is contained in:
atlas 2026-10-04 17:58:16 +02:00 • committed by mara
commit 3e1ac4e678
5 changed files with 91 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

51
nix/host-modules/hive-gateway/vhosts.nix
View file

@ -248,31 +248,34 @@ in
'';
};
}
// lib.optionalAttrs runsHive {
# The hive's own surface, reachable by NAME. Named rather than left
# to `_`, so the catch-all can reject everything else. Only where a
# hive runs: it proxies to hive-c0re, which runs only with the hive
# controller.
// lib.optionalAttrs (runsHive || matrixDeployCfg.enable) {
# The hive domain's own vhost, reachable by NAME, so the catch-all can
# reject everything else. It exists where it has something to serve:
# matrix discovery and the `/matrix/` redirect where the homeserver runs
# here, and the dashboard, agent routes and swagger UI where a hive runs
# (they proxy to hive-c0re, which runs only with the hive controller).
${hyperhiveDomain} = (vhostTlsFor hyperhiveDomain) // {
listen = vhostListen;
locations =
matrixRedirectLocations
// wellKnownLocations
// agentLocations
// dashboardProxyLocation
// swaggerUiLocations
// lib.optionalAttrs cfg.auth.enable {
# Internal-only target for the 401 error_page above.
# `internal` prevents direct client access; `alias` serves
# the pre-built HTML from the Nix store.
"= /__hive_auth_unauthorized" = {
extraConfig = ''
internal;
alias ${errorPages.unauthorized};
default_type text/html;
'';
};
};
// lib.optionalAttrs runsHive (
agentLocations
// dashboardProxyLocation
// swaggerUiLocations
// lib.optionalAttrs cfg.auth.enable {
# Internal-only target for the dashboard's 401 error_page.
# `internal` prevents direct client access; `alias` serves
# the pre-built HTML from the Nix store.
"= /__hive_auth_unauthorized" = {
extraConfig = ''
internal;
alias ${errorPages.unauthorized};
default_type text/html;
'';
};
}
);
# Per-agent location blocks, generated at runtime by
# hive-c0re and written to /var/lib/hive-gateway/conf/agents.conf
# on the host — the same machine nginx runs on. nginx parses
@ -281,9 +284,11 @@ in
# agents without a nixos-rebuild. nginx's longest-prefix-
# match rule ensures `/agent/<name>/` from this file beats
# the `/agent/` catch-all above.
extraConfig = securityHeaders + ''
include /var/lib/hive-gateway/conf/agents.conf;
'';
extraConfig =
securityHeaders
+ lib.optionalString runsHive ''
include /var/lib/hive-gateway/conf/agents.conf;
'';
};
};
}

19
nix/host-modules/hive-tls.nix
View file

@ -251,9 +251,8 @@ in
# generates or signs with a CA key. See
# `docs/networking/gateway.md` ("Self-signed TLS") and docs/swarm/ca.md.
#
# The trust bundle still carries the retired hive CA's public `ca.pem`
# where one exists, so a leaf it signed keeps verifying until it is
# replaced.
# The trust bundle also carries a hive CA's public `ca.pem` where one
# exists, so a leaf it signed verifies until it is replaced.
options.services.hyperhive.deploy.hive-controller.tls = {
stateDir = lib.mkOption {
@ -264,9 +263,9 @@ in
self-signed gateway mode: `gateway.pem` / `gateway-key.pem` (the
leaf the store issues and nginx serves) and `trust-bundle.pem` (the
anchors agents and federation peers trust). `ca.pem` and
`ca-previous.pem`, where present, are the retired hive CA's public
certificates and stay in the bundle. A `ca-key.pem` an earlier
generation left is neither read nor removed.
`ca-previous.pem`, where present, are a hive CA's public
certificates and stay in the bundle. A `ca-key.pem` here is neither
read nor removed.
'';
};
@ -421,8 +420,8 @@ in
#
# `swarm-services-root.pem` is the store's `pki` root, which both
# the gateway leaf and the swarm-services leaf chain to. `ca.pem`
# and `ca-previous.pem` are the retired hive CA's public
# certificates, kept so a leaf they signed verifies until replaced.
# and `ca-previous.pem` are a hive CA's public certificates, kept
# so a leaf they signed verifies until replaced.
bundle="$d/trust-bundle.pem"
anchors=()
if [ -s "$ca" ]; then anchors+=("$ca"); fi
@ -528,8 +527,8 @@ in
{ [ -s "$leaf" ] && [ -s "$leafk" ]; } || reissue=1
openssl x509 -in "$leaf" -noout -checkend "$renewat" >/dev/null 2>&1 || reissue=1
leavesCoverNames || reissue=1
# A leaf the retired hive CA signed, or one under a store root since
# replaced, fails this and is re-issued.
# A leaf that does not chain to the store's current root, whoever
# signed it, fails this and is re-issued.
{ [ -s "$svcroot" ] && openssl verify -CAfile "$svcroot" "$leaf" >/dev/null 2>&1; } || reissue=1
# The leaf and the key are two renames, so an interrupted rotation can
# leave a certificate beside a key it does not belong to.