vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-matrix: stateVersion 26.05 + drop premature federationPort firewall (argus nits #552)

Browse source
This commit is contained in:
damocles 2026-05-29 01:28:46 +02:00
commit 5a4eb3e053
1 changed files with 14 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nix/modules/hive-matrix.nix
View file

@ -102,25 +102,23 @@ in
'';
};
federationPort = lib.mkOption {
type = lib.types.port;
default = 8448;
description = ''
TCP port tuwunel serves the matrix server-server (federation)
API on. Default 8448 is the matrix-spec well-known port.
Open in the host firewall when `openFirewall = true`; needed
for multi-hive swarms to talk to each other.
'';
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Open `httpPort` + `federationPort` in the host firewall. Off
when the homeserver should only be reachable from inside the
host (e.g. while bringing the integration up before
announcing it to other hives).
Open `httpPort` in the host firewall. Off when the
homeserver should only be reachable from inside the host
(e.g. while bringing the integration up before announcing
it to other hives).
Note: federation (the matrix-spec well-known port 8448) is
intentionally not opened here. tuwunel serves the federation
API on the same `httpPort` as the client-server API by
default; reaching it on 8448 requires either binding tuwunel
to that port explicitly OR a reverse-proxy + `.well-known/
matrix/server` delegation, neither of which lives in this
module. Add that proxy config alongside whatever serves your
dashboard or forge on 443.
'';
};
@ -184,7 +182,7 @@ in
config =
{ ... }:
{
system.stateVersion = "25.11";
system.stateVersion = "26.05";
services.matrix-tuwunel = {
enable = true;
package = cfg.package;
@ -215,7 +213,6 @@ in
networking.firewall = lib.mkIf cfg.openFirewall {
allowedTCPPorts = [
cfg.httpPort
cfg.federationPort
];
};
};