vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: replace deprecated no-op options with mkRemovedOptionModule

Browse source
This commit is contained in:
müde 2026-07-13 21:58:30 +02:00
commit 7ad2bb9211
8 changed files with 85 additions and 189 deletions
Download patch file Download diff file Expand all files Collapse all files

37
nix/modules/hive-gateway/default.nix
View file

@ -28,8 +28,7 @@ let
# (`tls.certDir`) nor ACME (`tls.acme.enable`) is configured, the gateway
# generates + serves a hive-CA-signed leaf (see hive-tls.nix). There is no
# explicit toggle and no http-only mode — matrix discovery requires https,
# so the gateway always terminates TLS. The deprecated `selfSignedTls`
# option is a no-op kept only so existing configs eval (see warnings).
# so the gateway always terminates TLS.
# `cfg.useSelfSigned` (options.nix) is the derived single source of truth.
useSelfSigned = cfg.useSelfSigned;
in
@ -55,20 +54,6 @@ in
}
];
# Deprecation surface for the removed `selfSignedTls` toggle. Self-signed
# is now the implicit floor (used whenever neither `tls.certDir` nor
# `tls.acme` is set), so the toggle no longer does anything. Warn only
# when it's set to `false` — that's the case that previously meant
# "http-only / external-only", which no longer exists; `= true` matches
# the effective behaviour and stays silent to avoid noise.
warnings = lib.optional (!cfg.selfSignedTls) ''
services.hyperhive.gateway.selfSignedTls = false is deprecated and
ignored — self-signed TLS is now the default whenever no other TLS
source is configured, and there is no http-only mode. Remove the
setting; configure `tls.certDir` or `tls.acme` to override the
self-signed default.
'';
# Ensure bind-mount sources exist at host boot before the gateway
# container's first start. nspawn would auto-create missing dirs;
# tmpfiles rules make the intent explicit and cover the fresh-boot
@ -259,17 +244,15 @@ in
inherit (nginxTree) appendHttpConfig virtualHosts;
};
services.dnsmasq = lib.mkIf networkCfg.enable (
import ./dnsmasq.nix {
inherit
lib
networkCfg
forgeCfg
matrixCfg
hyperhiveDomain
;
}
);
services.dnsmasq = import ./dnsmasq.nix {
inherit
lib
networkCfg
forgeCfg
matrixCfg
hyperhiveDomain
;
};
};
};

29
nix/modules/hive-gateway/options.nix
View file

@ -12,6 +12,15 @@ let
cfg = config.services.hyperhive.gateway;
in
{
imports = [
(lib.mkRemovedOptionModule [ "services" "hyperhive" "gateway" "selfSignedTls" ] ''
Self-signed TLS is the implicit default whenever neither
tls.certDir nor tls.acme is configured, and there is no http-only
mode. Remove the setting; configure `tls.certDir` or `tls.acme`
to override the self-signed default.
'')
];
options.services.hyperhive.gateway = {
port = lib.mkOption {
type = lib.types.port;
@ -85,26 +94,6 @@ in
'';
};
selfSignedTls = lib.mkOption {
type = lib.types.bool;
default = true;
example = false;
description = ''
**DEPRECATED — ignored.** Self-signed TLS is now the implicit
default: when neither `tls.certDir` nor `tls.acme.enable` is
configured, the gateway generates and serves a hive-CA-signed
leaf (see the `hive-tls` module). There is no explicit toggle and
no http-only mode — matrix discovery hardcodes
`https://<host>/.well-known/matrix/client`, so the gateway always
terminates TLS. This option is retained as a no-op so existing
configs eval; setting it (to either value) warns and has no
effect, and it will be removed in a future release. Use
`tls.certDir` or `tls.acme` to override the self-signed default.
See `docs/gateway.md` ("Self-signed TLS").
'';
};
useSelfSigned = lib.mkOption {
type = lib.types.bool;
internal = true;