vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-gateway: keep matrix discovery on the hive domain of a homeserver host without a hive

Browse source 
The hive-domain vhost renders where a hive or the homeserver runs. Its
matrix .well-known JSON and /matrix/ redirect are served wherever the
homeserver runs; the dashboard, swagger UI, agent routes and the
agents.conf include only where a hive runs, since they proxy to hive-c0re.

The gateway doc's vhost map says which rows exist without a hive, and the
trust-bundle text describes ca.pem by what it is rather than as retired.

Refs #4588
This commit is contained in:
atlas 2026-10-04 17:58:16 +02:00 • committed by mara
commit 3e1ac4e678
5 changed files with 91 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

39
nix/module-eval/swarm-services-switch.nix
View file

@ -45,6 +45,13 @@ let
deploy.bao.enable = true;
};
# The homeserver on a host without a hive: its hive-domain vhost serves
# matrix discovery and nothing of the hive's.
matrixNoHive = hive {
deploy.hive-controller.enable = false;
deploy.matrix.enable = true;
};
# The same switch with every service it owns placed elsewhere, so the only
# thing that can enable the gateway/resolver/bridge here is that toggle's
# own module — each service module asserts them from its own `enable`.
@ -232,7 +239,25 @@ let
in
!(lib.any (t: lib.any (r: lib.hasInfix r t) hiveLeafRefs) texts)
&& m.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile == null
&& !(m.services.nginx.virtualHosts ? "h1.t.local");
&& noHiveSurface m;
# The hive-domain vhost, where it renders at all, carries nothing
# that proxies to hive-c0re.
noHiveSurface =
m:
let
vh = m.services.nginx.virtualHosts;
v = vh."h1.t.local";
in
!(vh ? "h1.t.local")
|| (
!(lib.any (l: v.locations ? ${l}) [
"/"
"/api/"
"/agent/"
"/api/docs/"
])
&& !(lib.hasInfix "agents.conf" (v.extraConfig or ""))
);
noHive =
m:
let
@ -277,13 +302,23 @@ let
store.services.hyperhive.swarm.localServiceDomains
== [ store.services.hyperhive.swarm.bao.ui.domain ]
&& !(waitsForLeaf store)
# The homeserver without a hive: the hive-domain vhost serves matrix
# discovery and the redirect, and no hive surface.
&& noHive matrixNoHive
&& (
let
l = matrixNoHive.services.nginx.virtualHosts."h1.t.local".locations;
in
l ? "= /.well-known/matrix/client" && l ? "= /.well-known/matrix/server"
)
&& !(store.services.nginx.virtualHosts ? "h1.t.local")
&& lib.hasInfix "want_svc=1" store.systemd.services.swarm-services-cert.script
# Control: a hive host with the same services keeps the hive leaf,
# its unit and identity, and the hive-domain vhost.
&& hs ? hive-tls-resign
&& lib.hasInfix "install -m 0644 /var/lib/hive-tls/gateway.pem /var/lib/hive-gateway/tls/cert.pem" hs.hive-gateway-self-signed-cert.script
&& swarmServicesHere.services.hyperhive.deploy.hive-controller.tls.baoHiveIdentityCertFile != null
&& swarmServicesHere.services.nginx.virtualHosts ? "h1.t.local"
&& swarmServicesHere.services.nginx.virtualHosts."h1.t.local".locations ? "/api/"
&& !(noHiveLeafAnywhere swarmServicesHere);
}
{