vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

reshape swarm peers: domain-as-key, certFingerprint field

Browse source
This commit is contained in:
damocles 2026-05-31 23:29:30 +02:00 • committed by mara
commit 52cfc3ea1c
3 changed files with 45 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

75
nix/modules/hive-c0re.nix
View file

@ -99,48 +99,31 @@ in
# containers via `meta.rs::FORWARDED_VARS`. Consumed by
# `identity.rs::peers()` + the dashboard's `peer_hives` state field
# (feeds the P33RS dashboard tab).
options.services.hyperhive.peers = lib.mkOption {
type = lib.types.attrsOf (
lib.types.submodule {
options = {
domain = lib.mkOption {
type = lib.types.str;
example = "lab.example.com";
description = ''
DNS domain of the peer hive. Used to construct the peer's
dashboard URL (`http://''${domain}/`) and for Matrix
federation auto-discovery (`matrix.''${domain}`).
Must be reachable from this host.
'';
};
tlsCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
Optional path to a PEM cert/bundle to trust for this peer's
TLS. Null = system CA bundle (for Let's Encrypt peers). Set
to the peer's self-signed cert for `selfSignedTls = true`
peers. Forward-compat slot; not yet used in v0.
'';
};
options.services.hyperhive.swarm.peers = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule {
options = {
certFingerprint = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "sha256:abc123...";
description = ''
Expected TLS certificate fingerprint for this peer's HTTPS
endpoint. Null = trust the system CA bundle (for Let's
Encrypt peers). Set to pin a self-signed cert.
'';
};
}
);
};
});
default = { };
example = {
lab = {
domain = "lab.example.com";
};
edge = {
domain = "edge.corp";
};
"lab.example.com" = { certFingerprint = "sha256:abc123"; };
"edge.corp" = { };
};
description = ''
Peer hives in the same swarm. The attrset key is a short label
used in dashboard links and log messages -- it does not need to
match the remote hive's `hiveName`. Null `tlsCertFile` uses the
system CA bundle; set it for self-signed TLS peers (forward-compat
slot, not yet used in v0).
Peer hives in the same swarm. The attrset key is the peer's DNS
domain — used for dashboard links and Matrix federation discovery.
Null `certFingerprint` trusts the system CA bundle; set it to pin
a self-signed TLS cert.
'';
};
@ -365,16 +348,16 @@ in
# falls back to `<hostname>:3000`.
HIVE_FORGE_PUBLIC_URL = "https://${config.services.hyperhive.forge.domain}";
}
// lib.optionalAttrs (config.services.hyperhive.peers != { }) {
# Peer hives serialised as a JSON array of {label, domain} objects.
# Consumed by hive-ag3nt::identity::peers() + the dashboard's
# peer_hives StateSnapshot field (P33RS tab). tlsCertFile is
# nix-side-only (host nginx/trust config); rust never needs the path.
// lib.optionalAttrs (config.services.hyperhive.swarm.peers != { }) {
# Peer hives serialised as a JSON array of {domain, cert_fingerprint}
# objects. Consumed by hive-ag3nt::identity::peers() + the dashboard's
# peer_hives StateSnapshot field (P33RS tab). Domain is the attrset key;
# cert_fingerprint is null for CA-trusted peers.
HYPERHIVE_PEERS = builtins.toJSON (
lib.mapAttrsToList (label: p: {
inherit label;
inherit (p) domain;
}) config.services.hyperhive.peers
lib.mapAttrsToList (domain: p: {
inherit domain;
cert_fingerprint = p.certFingerprint;
}) config.services.hyperhive.swarm.peers
);
};
serviceConfig = {