vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-gateway: keep matrix discovery on the hive domain of a homeserver host without a hive

Browse source 
The hive-domain vhost renders where a hive or the homeserver runs. Its
matrix .well-known JSON and /matrix/ redirect are served wherever the
homeserver runs; the dashboard, swagger UI, agent routes and the
agents.conf include only where a hive runs, since they proxy to hive-c0re.

The gateway doc's vhost map says which rows exist without a hive, and the
trust-bundle text describes ca.pem by what it is rather than as retired.

Refs #4588
This commit is contained in:
atlas 2026-10-04 17:58:16 +02:00 • committed by mara
commit 3e1ac4e678
5 changed files with 91 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

51
nix/host-modules/hive-gateway/vhosts.nix
View file

@ -248,31 +248,34 @@ in
'';
};
}
// lib.optionalAttrs runsHive {
# The hive's own surface, reachable by NAME. Named rather than left
# to `_`, so the catch-all can reject everything else. Only where a
# hive runs: it proxies to hive-c0re, which runs only with the hive
# controller.
// lib.optionalAttrs (runsHive || matrixDeployCfg.enable) {
# The hive domain's own vhost, reachable by NAME, so the catch-all can
# reject everything else. It exists where it has something to serve:
# matrix discovery and the `/matrix/` redirect where the homeserver runs
# here, and the dashboard, agent routes and swagger UI where a hive runs
# (they proxy to hive-c0re, which runs only with the hive controller).
${hyperhiveDomain} = (vhostTlsFor hyperhiveDomain) // {
listen = vhostListen;
locations =
matrixRedirectLocations
// wellKnownLocations
// agentLocations
// dashboardProxyLocation
// swaggerUiLocations
// lib.optionalAttrs cfg.auth.enable {
# Internal-only target for the 401 error_page above.
# `internal` prevents direct client access; `alias` serves
# the pre-built HTML from the Nix store.
"= /__hive_auth_unauthorized" = {
extraConfig = ''
internal;
alias ${errorPages.unauthorized};
default_type text/html;
'';
};
};
// lib.optionalAttrs runsHive (
agentLocations
// dashboardProxyLocation
// swaggerUiLocations
// lib.optionalAttrs cfg.auth.enable {
# Internal-only target for the dashboard's 401 error_page.
# `internal` prevents direct client access; `alias` serves
# the pre-built HTML from the Nix store.
"= /__hive_auth_unauthorized" = {
extraConfig = ''
internal;
alias ${errorPages.unauthorized};
default_type text/html;
'';
};
}
);
# Per-agent location blocks, generated at runtime by
# hive-c0re and written to /var/lib/hive-gateway/conf/agents.conf
# on the host — the same machine nginx runs on. nginx parses
@ -281,9 +284,11 @@ in
# agents without a nixos-rebuild. nginx's longest-prefix-
# match rule ensures `/agent/<name>/` from this file beats
# the `/agent/` catch-all above.
extraConfig = securityHeaders + ''
include /var/lib/hive-gateway/conf/agents.conf;
'';
extraConfig =
securityHeaders
+ lib.optionalString runsHive ''
include /var/lib/hive-gateway/conf/agents.conf;
'';
};
};
}