vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-matrix: stateVersion 26.05 + drop premature federationPort firewall (argus nits #552)

Browse source
This commit is contained in:
damocles 2026-05-29 01:28:46 +02:00
commit 5a4eb3e053
1 changed files with 14 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nix/modules/hive-matrix.nix
View file

@ -102,25 +102,23 @@ in
''; '';
}; };
federationPort = lib.mkOption {
type = lib.types.port;
default = 8448;
description = ''
TCP port tuwunel serves the matrix server-server (federation)
API on. Default 8448 is the matrix-spec well-known port.
Open in the host firewall when `openFirewall = true`; needed
for multi-hive swarms to talk to each other.
'';
};
openFirewall = lib.mkOption { openFirewall = lib.mkOption {
type = lib.types.bool; type = lib.types.bool;
default = true; default = true;
description = '' description = ''
Open `httpPort` + `federationPort` in the host firewall. Off Open `httpPort` in the host firewall. Off when the
when the homeserver should only be reachable from inside the homeserver should only be reachable from inside the host
host (e.g. while bringing the integration up before (e.g. while bringing the integration up before announcing
announcing it to other hives). it to other hives).
Note: federation (the matrix-spec well-known port 8448) is
intentionally not opened here. tuwunel serves the federation
API on the same `httpPort` as the client-server API by
default; reaching it on 8448 requires either binding tuwunel
to that port explicitly OR a reverse-proxy + `.well-known/
matrix/server` delegation, neither of which lives in this
module. Add that proxy config alongside whatever serves your
dashboard or forge on 443.
''; '';
}; };
@ -184,7 +182,7 @@ in
config = config =
{ ... }: { ... }:
{ {
system.stateVersion = "25.11"; system.stateVersion = "26.05";
services.matrix-tuwunel = { services.matrix-tuwunel = {
enable = true; enable = true;
package = cfg.package; package = cfg.package;
@ -215,7 +213,6 @@ in
networking.firewall = lib.mkIf cfg.openFirewall { networking.firewall = lib.mkIf cfg.openFirewall {
allowedTCPPorts = [ allowedTCPPorts = [
cfg.httpPort cfg.httpPort
cfg.federationPort
]; ];
}; };
}; };