vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

gateway: dial swarm services by name over verified TLS

Browse source 
Consumers reached authelia at `127.0.0.1:<port>`, which encoded a
co-location nobody agreed to: the gateway and authelia are not required
to share a host, so the literal is a requirement stated only by being
unwriteable any other way. Moving them to the name is the point of the
issue.

But a name over https is only half of "https and auth". nginx's
`proxy_ssl_verify` is OFF by default and there was no `proxy_ssl_*`
anywhere in the tree, so the obvious repoint would have produced an
encrypted, unauthenticated hop -- which works, and keeps working,
against any certificate at all.

Adds `gateway.lib.verifiedProxyTo <name>` next to the rest of the vhost
kit, so the convention has one definition rather than a copy in each
consuming module, and repoints the four call sites through it.

Each directive was checked against a real nginx with the opposite arm
run as a control:

  - the CA *bundle* (root + intermediate) is accepted -- worth checking,
    since `hive-ca-trust.nix` warns off consumers that read only one
    certificate, and nginx is not one of those
  - verification checks the chain: an unrelated CA fails
  - and the HOSTNAME: a wrong `proxy_ssl_name` fails even with a good
    chain. Chain-only would accept any cert this CA ever signed, which
    for an internal CA is every service on the hive
  - with verify off, the wrong CA passes -- so the failures above come
    from verification, not from the connection

Bind addresses are untouched. This changes what consumers dial, not what
anything listens on.
This commit is contained in:
atlas 2026-08-27 11:33:44 +02:00 • committed by mara
commit 43ae164d8b
6 changed files with 78 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nix/host-modules/hive-gateway/options.nix
View file

@ -172,6 +172,29 @@ in
'';
};
verifiedProxyTo = lib.mkOption {
type = lib.types.functionTo lib.types.lines;
internal = true;
readOnly = true;
description = ''
Read-only: `name -> the proxy_ssl_* lines` for dialling
another service on this hive **by name over https**, with the
certificate actually verified against the hive CA bundle.
Published rather than written per module because nginx
verifies nothing by default: `proxy_ssl_verify` is **off**, so
a `proxy_pass https://…` that omits these is encrypted and
unauthenticated — which is the half of "https and auth" that
is easy to believe you already have.
Measured, not copied: verification is confirmed to check both
the chain and the **hostname**, and the CA *bundle* (root +
intermediate) is confirmed to be accepted — the bundle's own
doc warns off consumers that read only one certificate, and
nginx is not one of those.
'';
};
securityHeaders = lib.mkOption {
type = lib.types.lines;
internal = true;