vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

drop the hive-side matrix code: sweep, hivectl matrix and the apiUrl option

Browse source
This commit is contained in:
damocles 2026-10-28 22:16:16 +01:00 • committed by mara
commit 6dbb18b6d4
4 changed files with 49 additions and 1007 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/host-modules/hive-c0re/default.nix
View file

@ -115,9 +115,8 @@ in
./options.nix
./theme.nix
./vhosts.nix
# Hive-CA trust for this daemon's outbound TLS. The matrix provisioning
# URL (`swarm.matrix.apiUrl`) defaults to https on the homeserver's
# gateway vhost, which serves a leaf chaining to the store's pki root —
# Hive-CA trust for this daemon's outbound TLS. The swarm services it
# reaches over https serve a leaf chaining to the store's pki root —
# a CA generated at runtime, which no build-time trust store can
# contain. The queue's TLS is verified against `HIVE_C0RE_OIDC_CA_FILE`
# (../glue-hive-tls-controllers.nix), not this bundle.

9
nix/host-modules/hive-c0re/environment.nix
View file

@ -168,15 +168,6 @@ in
# answer when there is no matrix vhost to point at.
HIVE_MATRIX_URL = "http://${config.services.hyperhive.swarm.matrix.gatewayHost}";
}
// lib.optionalAttrs (config.services.hyperhive.swarm.matrix.apiUrl != null) {
# Client-server API base hive-c0re uses to provision matrix (register
# agent users, invite members).
# Supplied by `services.hyperhive.swarm.matrix.apiUrl`, which defaults to
# the same gateway vhost as HIVE_MATRIX_URL above, over https because it
# carries the hive's matrix token and may cross the network. Its own
# option, so provisioning can point elsewhere without changing agents.
HIVE_MATRIX_API_URL = config.services.hyperhive.swarm.matrix.apiUrl;
}
// {
# The gateway always runs, so the dashboard always builds
# same-origin `/agent/<name>/` links (never the direct

37
nix/host-modules/hive-matrix-service.nix
View file

@ -12,6 +12,12 @@ let
swarmDomain = config.services.hyperhive.swarm.domain;
in
{
imports = [
(lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "matrix" "apiUrl" ] ''
hive-c0re no longer talks to matrix, so it has no API URL to set: matrix is swarm-level.
'')
];
options.services.hyperhive.swarm.matrix = {
serverName = lib.mkOption {
type = lib.types.nullOr lib.types.str;
@ -49,37 +55,6 @@ in
'';
};
apiUrl = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = if cfg.gatewayHost == null then null else "https://${cfg.gatewayHost}";
defaultText = lib.literalExpression ''
if services.hyperhive.swarm.matrix.gatewayHost == null then null
else "https://''${services.hyperhive.swarm.matrix.gatewayHost}"
'';
example = "https://matrix.example.com";
description = ''
Client-server API base URL **hive-c0re itself** uses to
provision matrix (register agent users, invite members). Distinct from the agent-facing
`services.hyperhive.agent.matrix.url`, which is the gateway vhost handed to
each agent's `hive-matrix-daemon`.
Defaults to `https://` on the homeserver's gateway vhost
(`gatewayHost`), the same name on every hive whichever host runs
tuwunel, and `null` when there is no vhost. hive-c0re logs in
with the hive's matrix sender token over this URL, so it crosses
the network whenever hive-c0re is not on the homeserver's host:
an `http://` value sends that token in cleartext. hive-c0re
verifies the gateway's certificate against the hive trust bundle
(system CAs plus the swarm and services roots).
`null` means hive-c0re has no homeserver to provision against
and matrix provisioning no-ops. There is deliberately no
fallback compiled into the daemon: an address baked into the
binary is one that builds fine and then talks to the wrong
machine.
'';
};
gatewayHost = lib.mkOption {
type = lib.types.nullOr lib.types.str;
# `chat.` under the SWARM domain — both halves change: a swarm runs

12
nix/module-eval/matrix-core.nix
View file

@ -127,18 +127,6 @@ let
&& lib.hasInfix "exit 1" u.script
&& !(lib.hasInfix "bao login" u.script);
}
{
# hive-c0re logs in with the hive's matrix token over this URL, and on a
# host without the homeserver that login crosses the network, so the
# default must be TLS all the way to the daemon's environment.
name = "hive-c0re provisions matrix over https from a hive that does not run it";
ok =
!matrixElsewhere.services.hyperhive.deploy.matrix.enable
&& matrixElsewhere.services.hyperhive.swarm.matrix.apiUrl == "https://chat.t.local"
&&
matrixElsewhere.systemd.services.hive-c0re.environment.HIVE_MATRIX_API_URL
== "https://chat.t.local";
}
{
# The legacy redirect reaches the hive domain's vhost from a glue
# module, merged into the vhost hive-c0re declares, and only where the