From 600fa15afe09875188f27a85cbd834f85f60cf97 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 12 Aug 2026 17:43:35 +0200
Subject: [PATCH] feat(3167): publish the swarm UI's name to agents and to
 local dev

Four wiring sites, same as forge/matrix/authelia: vhost, cert name, DNS,
local-dev hosts. This commit is the last two.

The apex is a SIBLING of forge./chat./auth., not a child of anything
dnsmasq already answers for, so the /<hive domain>/ rule does not cover
it - without an explicit record the name is unresolvable from every
agent netns while working fine from the host, which is the shape that
nearly shipped when authelia's name moved.

Published to agents deliberately (mara: publishing it is fine).
Reachability is not the access control: the vhost's auth_request plus
authelia's group:operators rule are, and an agent that resolves the name
still cannot open the page.
---
 nix/host-modules/hive-gateway/default.nix |  2 ++
 nix/host-modules/hive-gateway/dnsmasq.nix | 12 +++++++++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/nix/host-modules/hive-gateway/default.nix b/nix/host-modules/hive-gateway/default.nix
index 0addddfe..b573a93a 100644
--- a/nix/host-modules/hive-gateway/default.nix
+++ b/nix/host-modules/hive-gateway/default.nix
@@ -310,6 +310,7 @@ in
         forgeCfg
         matrixCfg
         autheliaCfg
+        uiCfg
         hyperhiveDomain
         ;
     };
@@ -334,6 +335,7 @@ in
         ) config.services.hyperhive.swarm.forge.domain
         ++ lib.optional (matrixCfg.enable && matrixCfg.gatewayHost != null) matrixCfg.gatewayHost
         ++ lib.optional autheliaCfg.enable autheliaCfg.domain
+        ++ lib.optional uiCfg.enable uiCfg.domain
       );
     };
   };
diff --git a/nix/host-modules/hive-gateway/dnsmasq.nix b/nix/host-modules/hive-gateway/dnsmasq.nix
index d5096188..cd56e226 100644
--- a/nix/host-modules/hive-gateway/dnsmasq.nix
+++ b/nix/host-modules/hive-gateway/dnsmasq.nix
@@ -11,6 +11,7 @@
   forgeCfg,
   matrixCfg,
   autheliaCfg,
+  uiCfg,
   hyperhiveDomain,
 }:
 {
@@ -60,7 +61,16 @@
     ++ lib.optional (
       matrixCfg.enable && matrixCfg.gatewayHost != null
     ) "/${matrixCfg.gatewayHost}/${networkCfg.bridgeIp}"
-    ++ lib.optional autheliaCfg.enable "/${autheliaCfg.domain}/${networkCfg.bridgeIp}";
+    ++ lib.optional autheliaCfg.enable "/${autheliaCfg.domain}/${networkCfg.bridgeIp}"
+    # The swarm UI's name is the swarm APEX by default — a sibling of
+    # the three above, not a child of anything this resolver already
+    # answers for, so the `/<hive domain>/` rule does not cover it.
+    #
+    # Published to agents deliberately (mara: publishing it is fine).
+    # Reachability is not the access control here: the vhost's
+    # `auth_request` + authelia's `group:operators` rule are, and an
+    # agent that resolves the name still cannot open the page.
+    ++ lib.optional uiCfg.enable "/${uiCfg.domain}/${networkCfg.bridgeIp}";
     # DHCP pool covering all usable host addresses on the bridge
     # subnet — bounds computed by hive-network.nix from
     # bridgeIp/bridgePrefixLength. All containers (agents and service