vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

nix(c0re): guard agent forge/matrix URLs on hyperhive.enable, not network.enable

Browse source 
Addresses argus's review of #1718: the HIVE_FORGE_URL / HIVE_MATRIX_URL
conditionals still keyed off the now-deprecated `network.enable`, so
setting it to `false` would point agents at host loopback (unreachable
from their private netns) even though isolation stays on — contradicting
the "deprecated and ignored" warning. Guard on the top-level
`hyperhive.enable` instead, so `network.enable` truly has no effect
anywhere and the loopback branch only covers a hyperhive-disabled host.

Eval-proven: with `network.enable = false`, HIVE_FORGE_URL now resolves
to the gateway vhost (`http://forge.<domain>`), and the deprecation
warning still fires.
This commit is contained in:
atlas 2026-06-17 16:07:39 +02:00
commit 61db5afc22
1 changed files with 13 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

26
nix/modules/hive-c0re.nix
View file

@ -758,11 +758,13 @@ in
# See `docs/gateway.md::HIVE_FORGE_URL`. # See `docs/gateway.md::HIVE_FORGE_URL`.
# Network isolation is now unconditional (the shared-netns mode was # Network isolation is now unconditional (the shared-netns mode was
# removed), so agents always reach the forge through the gateway # removed), so agents always reach the forge through the gateway
# vhost rather than host loopback. The `network.enable` guard remains # vhost rather than host loopback. Guard on the top-level
# only so a deliberately network-less deployment still falls back to # `hyperhive.enable` (not the deprecated `network.enable`): the
# loopback; in the normal case it is always on. # network is always on with hyperhive, so the deprecated toggle has
# no effect here either — the loopback branch only covers a config
# with hyperhive itself disabled (no agents to serve).
HIVE_FORGE_URL = HIVE_FORGE_URL =
if config.services.hyperhive.network.enable then if config.services.hyperhive.enable then
"http://${config.services.hyperhive.forge.domain}" "http://${config.services.hyperhive.forge.domain}"
else else
"http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}"; "http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}";
@ -772,16 +774,14 @@ in
# hive-matrix-daemon. Same shape + rationale as HIVE_FORGE_URL: # hive-matrix-daemon. Same shape + rationale as HIVE_FORGE_URL:
# network isolation is now unconditional, so agents reach tuwunel # network isolation is now unconditional, so agents reach tuwunel
# via the gateway vhost (`matrix.<domain>`) on plain http:80 rather # via the gateway vhost (`matrix.<domain>`) on plain http:80 rather
# than host loopback. The gatewayHost null-guard falls back to # than host loopback. Guard on the top-level `hyperhive.enable` (the
# loopback so a domain-less config still evals; the `network.enable` # deprecated `network.enable` has no effect); the gatewayHost
# guard covers a deliberately network-less deployment. Forwarded to # null-guard falls back to loopback so a domain-less config still
# agents by meta.rs alongside HIVE_FORGE_URL; shares the same # evals. Forwarded to agents by meta.rs alongside HIVE_FORGE_URL;
# env-forwarding ordering caveat (value baked at config-generation # shares the same env-forwarding ordering caveat (value baked at
# time). # config-generation time).
HIVE_MATRIX_URL = HIVE_MATRIX_URL =
if if config.services.hyperhive.enable && config.services.hyperhive.matrix.gatewayHost != null then
config.services.hyperhive.network.enable && config.services.hyperhive.matrix.gatewayHost != null
then
"http://${config.services.hyperhive.matrix.gatewayHost}" "http://${config.services.hyperhive.matrix.gatewayHost}"
else else
"http://127.0.0.1:${toString config.services.hyperhive.matrix.httpPort}"; "http://127.0.0.1:${toString config.services.hyperhive.matrix.httpPort}";