vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: declare the gateway's own vhosts under gateway.vhosts

Browse source 
The catch-all, the dashboard and the hive-domain vhost were built in
vhosts.nix with the listen set, TLS attrs and headers applied by hand.
They are declared under services.hyperhive.gateway.vhosts now, so every
vhost behind the gateway goes through declared-vhosts.nix.

Two gateway-side rules cover what the catch-all needed: a vhost can set
securityHeaders = false (the catch-all only returns 444), and `default`
is rendered at mkDefault priority so an operator's own default vhost
still wins. The matrix discovery locations are unchanged.

The rendered nginx vhosts are unchanged.
This commit is contained in:
atlas 2026-10-16 13:19:36 +02:00 • committed by mara
commit 68e30957e2
6 changed files with 97 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

49
nix/module-eval/core-toggle.nix
View file

@ -430,6 +430,55 @@ let
&& lib.elem "h1.hives.t.local" allLocal.services.hyperhive.gateway.localNames
&& allLocal.systemd.services.hive-c0re.environment.HYPERHIVE_DASHBOARD_DOMAIN == "h1.hives.t.local";
}
{
# The gateway's own three vhosts are declared under `gateway.vhosts` like
# a service's, so the gateway's listen set and issuer choice reach them
# by the same path. The catch-all keeps its bare `return 444;` (no
# headers: it sends no response) and the dashboard keeps its exact
# location set.
name = "the gateway's own vhosts render with its listen set, issuer choice, headers and locations";
ok =
let
gw = allLocal.services.hyperhive.gateway;
vh = allLocal.services.nginx.virtualHosts;
listenOf = map (l: {
inherit (l) addr port;
ssl = l.ssl or false;
});
sameListen = v: listenOf v.listen == listenOf gw.lib.listen;
sameCert = name: v: v.sslCertificate == (gw.lib.tlsFor name).sslCertificate;
catchAll = vh."_";
dash = vh."h1.hives.t.local";
hive = vh."h1.t.local";
in
sameListen catchAll
&& sameCert "_" catchAll
&& catchAll.addSSL
&& catchAll.default
&& catchAll.extraConfig == "return 444;\n"
&& sameListen dash
&& sameCert "h1.hives.t.local" dash
&& dash.forceSSL
&& !(dash.addSSL or false)
&& dash.extraConfig == gw.lib.securityHeaders + "include /var/lib/hive-gateway/conf/agents.conf;\n"
&&
lib.attrNames dash.locations == [
"/"
"/agent/"
"/api/"
"/api/docs/"
"/health/"
"= /__hive_agent_not_found"
"= /__hive_agent_unreachable"
"= /__hive_authelia"
"= /api/docs"
]
&& sameListen hive
&& sameCert "h1.t.local" hive
&& hive.addSSL
&& hive.extraConfig == gw.lib.securityHeaders
&& hive.locations ? "/";
}
{
# The file held bcrypt hashes at 0644; a host carrying one from before
# gets it deleted, and nothing names it for nginx.