vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

matrix apiUrl: default to https on the gateway vhost

Browse source 
hive-c0re logs in with the hive's matrix sender token and creates the
Space and rooms over swarm.matrix.apiUrl. On a hive that does not run
the homeserver that crosses the network, so the default is now
https://<gatewayHost>. hive-c0re already verifies against the hive trust
bundle (SSL_CERT_FILE: system CAs, swarm root and the store's services
root), which covers the gateway's leaf for that name.

Also drops the remaining loopback-default wording in hive-c0re's matrix
module and the openFirewall description, and pins the https default on a
hive host without the homeserver in module-eval-matrix-core.
This commit is contained in:
atlas 2026-10-04 18:13:47 +02:00
commit 55a67e38fa
7 changed files with 56 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/host-modules/hive-matrix-service.nix
View file

@ -64,10 +64,10 @@ in
apiUrl = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = if cfg.gatewayHost == null then null else "http://${cfg.gatewayHost}";
default = if cfg.gatewayHost == null then null else "https://${cfg.gatewayHost}";
defaultText = lib.literalExpression ''
if services.hyperhive.swarm.matrix.gatewayHost == null then null
else "http://''${services.hyperhive.swarm.matrix.gatewayHost}"
else "https://''${services.hyperhive.swarm.matrix.gatewayHost}"
'';
example = "https://matrix.example.com";
description = ''
@ -77,10 +77,14 @@ in
`hyperhive.matrix.url`, which is the gateway vhost handed to
each agent's `hive-matrix-daemon`.
Defaults to the homeserver's gateway vhost (`gatewayHost`), the
same name on every hive whichever host runs tuwunel, and `null`
when there is no vhost. Set it explicitly when the homeserver is
reachable only some other way.
Defaults to `https://` on the homeserver's gateway vhost
(`gatewayHost`), the same name on every hive whichever host runs
tuwunel, and `null` when there is no vhost. hive-c0re logs in
with the hive's matrix sender token over this URL, so it crosses
the network whenever hive-c0re is not on the homeserver's host:
an `http://` value sends that token in cleartext. hive-c0re
verifies the gateway's certificate against the hive trust bundle
(system CAs plus the swarm and services roots).
`null` means hive-c0re has no homeserver to provision against
and matrix provisioning no-ops. There is deliberately no