vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

refactor(3202): authelia declares its own vhost and dns name

Browse source 
Moves the authelia vhost out of the gateway's vhosts.nix and its
`address=` rule out of dnsmasq.nix, into swarm-authelia.nix.

Both land inside that module's existing `cfg.enable` guard, which is
the load-bearing part: every hive in a swarm knows `authelia.url`, but
only the host that RUNS the container may claim the name. A client hive
declaring the vhost would answer for a service it does not run, and
publishing the DNS record would point every agent on its bridge at that
wrong answer.

The kit grows a fourth member, `errorPages`, because the vhost aims its
502/503/504 at the gateway's styled sso-unavailable page. Republished
rather than imported per module: a service rendering its own would drift
from the rest of the gateway the first time the theme changed.
This commit is contained in:
atlas 2026-08-13 12:50:55 +02:00
commit 56ab6d26c1
6 changed files with 91 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/hive-gateway/vhost-lib.nix
View file

@ -22,6 +22,7 @@
svcCert, # swarm-services leaf, for names the hive CA cannot sign
svcKey,
swarmServiceDomains, # which names those are (../swarm.nix derives it)
errorPages, # ./error-pages.nix: { notFound, unreachable, unauthorized, ssoUnavailable }
}:
let
# nixos `services.nginx.virtualHosts.<name>` ssl attrs for a vhost
@ -98,4 +99,11 @@ in
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
${lib.optionalString cfg.hsts.enable ''add_header Strict-Transport-Security "${hstsDirectives}" always;''}
'';
# The gateway's styled error pages, re-exported so a service module
# can point an `error_page` at one. Republished rather than imported
# per module for the same reason as everything else in this kit: these
# carry the hive's branding, and a service rendering its own would
# drift from the rest of the gateway the first time the theme changes.
inherit errorPages;
}