vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-gateway: keep matrix discovery on the hive domain of a homeserver host without a hive

Browse source 
The hive-domain vhost renders where a hive or the homeserver runs. Its
matrix .well-known JSON and /matrix/ redirect are served wherever the
homeserver runs; the dashboard, swagger UI, agent routes and the
agents.conf include only where a hive runs, since they proxy to hive-c0re.

The gateway doc's vhost map says which rows exist without a hive, and the
trust-bundle text describes ca.pem by what it is rather than as retired.

Refs #4588
This commit is contained in:
atlas 2026-10-04 17:58:16 +02:00 • committed by mara
commit 3e1ac4e678
5 changed files with 91 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/host-modules/hive-tls.nix
View file

@ -251,9 +251,8 @@ in
# generates or signs with a CA key. See
# `docs/networking/gateway.md` ("Self-signed TLS") and docs/swarm/ca.md.
#
# The trust bundle still carries the retired hive CA's public `ca.pem`
# where one exists, so a leaf it signed keeps verifying until it is
# replaced.
# The trust bundle also carries a hive CA's public `ca.pem` where one
# exists, so a leaf it signed verifies until it is replaced.
options.services.hyperhive.deploy.hive-controller.tls = {
stateDir = lib.mkOption {
@ -264,9 +263,9 @@ in
self-signed gateway mode: `gateway.pem` / `gateway-key.pem` (the
leaf the store issues and nginx serves) and `trust-bundle.pem` (the
anchors agents and federation peers trust). `ca.pem` and
`ca-previous.pem`, where present, are the retired hive CA's public
certificates and stay in the bundle. A `ca-key.pem` an earlier
generation left is neither read nor removed.
`ca-previous.pem`, where present, are a hive CA's public
certificates and stay in the bundle. A `ca-key.pem` here is neither
read nor removed.
'';
};
@ -421,8 +420,8 @@ in
#
# `swarm-services-root.pem` is the store's `pki` root, which both
# the gateway leaf and the swarm-services leaf chain to. `ca.pem`
# and `ca-previous.pem` are the retired hive CA's public
# certificates, kept so a leaf they signed verifies until replaced.
# and `ca-previous.pem` are a hive CA's public certificates, kept
# so a leaf they signed verifies until replaced.
bundle="$d/trust-bundle.pem"
anchors=()
if [ -s "$ca" ]; then anchors+=("$ca"); fi
@ -528,8 +527,8 @@ in
{ [ -s "$leaf" ] && [ -s "$leafk" ]; } || reissue=1
openssl x509 -in "$leaf" -noout -checkend "$renewat" >/dev/null 2>&1 || reissue=1
leavesCoverNames || reissue=1
# A leaf the retired hive CA signed, or one under a store root since
# replaced, fails this and is re-issued.
# A leaf that does not chain to the store's current root, whoever
# signed it, fails this and is re-issued.
{ [ -s "$svcroot" ] && openssl verify -CAfile "$svcroot" "$leaf" >/dev/null 2>&1; } || reissue=1
# The leaf and the key are two renames, so an interrupted rotation can
# leave a certificate beside a key it does not belong to.