vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-tls: a store-only host without a hive starts its gateway with the store sealed

Browse source 
A gateway host without a hive whose only swarm name is the store's UI no
longer waits for swarm-services-cert: its nginx carries the stream
passthrough to the store and must come up while the store is sealed. Until
the services leaf lands, hive-gateway-self-signed-cert installs a throwaway
self-signed pair on the default and swarm-services paths there; on a host
without a hive it never references the hive leaf.

A host without a hive also no longer mints the hive-leaf identity or
defaults the options pointing at it, and does not render the hive-domain
vhost, whose upstream is hive-c0re.

Refs #4588
This commit is contained in:
atlas 2026-10-04 17:24:11 +02:00 • committed by mara
commit 60268b70b0
9 changed files with 168 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/host-modules/hive-gateway/vhosts.nix
View file

@ -18,6 +18,7 @@
matrixCfg, # services.hyperhive.swarm.matrix — what the homeserver IS
matrixDeployCfg, # services.hyperhive.deploy.matrix — what THIS host runs
hyperhiveDomain,
runsHive, # deploy.hive-controller.enable — whether hive-c0re runs here
dashboardDist,
swaggerUiTheme, # nix/packages/swagger-ui-theme.nix: has index.html + hyperhive-theme.css
errorPages, # ./error-pages.nix: { notFound, unreachable, unauthorized, ssoUnavailable }
@ -246,13 +247,12 @@ in
return 444;
'';
};
# The hive's own surface, now reachable by NAME. This used to be
# served by the `_` vhost above: no vhost was named for the hive
# domain, so every dashboard and agent-UI request matched the
# default server instead (confirmed against 24h of nginx's access
# log — `server: _` on requests whose Host *was* the hive domain).
# Naming it is what lets the catch-all start rejecting.
}
// lib.optionalAttrs runsHive {
# The hive's own surface, reachable by NAME. Named rather than left
# to `_`, so the catch-all can reject everything else. Only where a
# hive runs: it proxies to hive-c0re, which runs only with the hive
# controller.
${hyperhiveDomain} = (vhostTlsFor hyperhiveDomain) // {
listen = vhostListen;
locations =