From 5ec1306c7b2ada103b7bdc0c354574b15a07c9a0 Mon Sep 17 00:00:00 2001 From: atlas Date: Thu, 4 Jun 2026 12:22:06 +0200 Subject: [PATCH] feat(gateway): assert hsts.enable requires TLS Addresses mara's review: add a NixOS assertion that rejects hsts.enable = true when no TLS mode is configured. HSTS over plain HTTP is silently ignored by browsers; the assertion turns a silent misconfiguration into a build-time error. --- nix/modules/hive-gateway.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index c5b619c4..6f2696ee 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -417,6 +417,18 @@ in Let's Encrypt needs a contact address for the ACME account. ''; } + { + assertion = + !cfg.hsts.enable + || cfg.selfSignedTls + || cfg.tls.certDir != null + || cfg.tls.acme.enable; + message = '' + services.hyperhive.gateway.hsts.enable = true requires TLS to be + configured (selfSignedTls, tls.certDir, or tls.acme.enable). HSTS + over plain HTTP is ignored by browsers and indicates a config error. + ''; + } ]; # Ensure bind-mount sources exist at host boot before the gateway