vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

matrix apiUrl: default to https on the gateway vhost

Browse source 
hive-c0re logs in with the hive's matrix sender token and creates the
Space and rooms over swarm.matrix.apiUrl. On a hive that does not run
the homeserver that crosses the network, so the default is now
https://<gatewayHost>. hive-c0re already verifies against the hive trust
bundle (SSL_CERT_FILE: system CAs, swarm root and the store's services
root), which covers the gateway's leaf for that name.

Also drops the remaining loopback-default wording in hive-c0re's matrix
module and the openFirewall description, and pins the https default on a
hive host without the homeserver in module-eval-matrix-core.
This commit is contained in:
atlas 2026-10-04 18:13:47 +02:00
commit 55a67e38fa
7 changed files with 56 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/integrations/matrix.md
View file

@ -83,11 +83,18 @@ pin the value before the homeserver mints any ids under the default.
## Default-closed firewall
`deploy.matrix.openFirewall` defaults to `false`: hive-c0re and agent
containers on every hive reach the homeserver at `chat.<swarm-domain>`
via the gateway, so the firewall hole only matters for direct access to
`httpPort` from *outside* the host. Flip to `true` when
announcing the homeserver to other hives or when an external matrix
client needs to reach the client-server API directly.
containers reach the homeserver at `chat.<swarm-domain>` via the gateway,
so the firewall hole only matters for direct access to `httpPort` from
*outside* the host. Flip to `true` when announcing the homeserver to
other hives or when an external matrix client needs to reach the
client-server API directly.
hive-c0re provisions matrix (its own sender login, the hive Space and
chat room, invites) through `swarm.matrix.apiUrl`, which defaults to
`https://<swarm.matrix.gatewayHost>` on every hive. That login carries
the hive's matrix access token, and on a hive that doesn't run the
homeserver it crosses the network, so the default is TLS; hive-c0re
verifies the gateway's certificate against the hive trust bundle.
Federation port 8448 is intentionally not opened here — tuwunel
serves the federation API on the same `httpPort` as client-server