vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(gateway): hivectl gateway user management + fix htpasswdFile assertion

Browse source 
Add `hivectl gateway {create-user,delete-user,list-users}` subcommands for
managing htpasswd files used by gateway Basic auth. Pure Rust bcrypt
(cost 12, $2y$ prefix nginx accepts). No external htpasswd binary required.

Also fix the NixOS module assertion: `cfg.auth ? htpasswdFile` is always
true in the module system (declared options always exist as keys); switch
to `nullOr path; default = null` + `!= null` check so the assertion
actually fires with a useful error when enable=true but no file is set.
Guard bind-mount and nginx config against null to prevent eval errors.

Update docs/gateway.md to show hivectl commands instead of raw htpasswd.
This commit is contained in:
atlas 2026-06-01 23:00:38 +02:00
commit 4bff450343
61 changed files with 1084 additions and 547 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/gateway.md
View file

@ -356,16 +356,27 @@ services.hyperhive.gateway.auth = {
};
```
Create the htpasswd file on the host:
Manage users with `hivectl gateway`:
```sh
# Create new file with first user (BCrypt, recommended):
htpasswd -Bc /etc/hyperhive/gateway.htpasswd alice
# Add or update a user (prompted for password):
hivectl gateway create-user --file /etc/hyperhive/gateway.htpasswd alice --password-stdin
# Add subsequent users:
htpasswd -B /etc/hyperhive/gateway.htpasswd bob
# Add with inline password (visible in shell history — avoid for sensitive creds):
hivectl gateway create-user --file /etc/hyperhive/gateway.htpasswd bob --password hunter2
# Remove a user:
hivectl gateway delete-user --file /etc/hyperhive/gateway.htpasswd bob
# List current usernames:
hivectl gateway list-users --file /etc/hyperhive/gateway.htpasswd
```
`hivectl gateway create-user` hashes passwords with BCrypt (cost 12) and
writes `$2y$`-prefixed hashes that nginx accepts natively. No external
`htpasswd` binary is required. The file is created on first add if absent;
its parent directory must already exist.
The file must be readable by the `nginx` user inside the container
(`chmod 0644`). The module bind-mounts the file's parent directory
read-only into the container at `/run/gateway-auth/`; nginx reads