vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(3167): publish the swarm UI's name to agents and to local dev

Browse source 
Four wiring sites, same as forge/matrix/authelia: vhost, cert name, DNS,
local-dev hosts. This commit is the last two.

The apex is a SIBLING of forge./chat./auth., not a child of anything
dnsmasq already answers for, so the /<hive domain>/ rule does not cover
it - without an explicit record the name is unresolvable from every
agent netns while working fine from the host, which is the shape that
nearly shipped when authelia's name moved.

Published to agents deliberately (mara: publishing it is fine).
Reachability is not the access control: the vhost's auth_request plus
authelia's group:operators rule are, and an agent that resolves the name
still cannot open the page.
This commit is contained in:
atlas 2026-08-12 17:43:35 +02:00
commit 600fa15afe
2 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/host-modules/hive-gateway/default.nix
View file

@ -310,6 +310,7 @@ in
forgeCfg
matrixCfg
autheliaCfg
uiCfg
hyperhiveDomain
;
};
@ -334,6 +335,7 @@ in
) config.services.hyperhive.swarm.forge.domain
++ lib.optional (matrixCfg.enable && matrixCfg.gatewayHost != null) matrixCfg.gatewayHost
++ lib.optional autheliaCfg.enable autheliaCfg.domain
++ lib.optional uiCfg.enable uiCfg.domain
);
};
};

12
nix/host-modules/hive-gateway/dnsmasq.nix
View file

@ -11,6 +11,7 @@
forgeCfg,
matrixCfg,
autheliaCfg,
uiCfg,
hyperhiveDomain,
}:
{
@ -60,7 +61,16 @@
++ lib.optional (
matrixCfg.enable && matrixCfg.gatewayHost != null
) "/${matrixCfg.gatewayHost}/${networkCfg.bridgeIp}"
++ lib.optional autheliaCfg.enable "/${autheliaCfg.domain}/${networkCfg.bridgeIp}";
++ lib.optional autheliaCfg.enable "/${autheliaCfg.domain}/${networkCfg.bridgeIp}"
# The swarm UI's name is the swarm APEX by default — a sibling of
# the three above, not a child of anything this resolver already
# answers for, so the `/<hive domain>/` rule does not cover it.
#
# Published to agents deliberately (mara: publishing it is fine).
# Reachability is not the access control here: the vhost's
# `auth_request` + authelia's `group:operators` rule are, and an
# agent that resolves the name still cannot open the page.
++ lib.optional uiCfg.enable "/${uiCfg.domain}/${networkCfg.bridgeIp}";
# DHCP pool covering all usable host addresses on the bridge
# subnet — bounds computed by hive-network.nix from
# bridgeIp/bridgePrefixLength. All containers (agents and service