vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

always include a hive's own allowedDomains in the rendered swarm-wide list

Browse source
This commit is contained in:
atlas 2026-10-29 01:47:25 +01:00 • committed by mara
commit 7e2f4ce7c8
2 changed files with 141 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

2
swarm-controller/src/backend_egress.rs
View file

@ -508,7 +508,7 @@ mod tests {
.await
.expect("the queue answers")
.is_none(),
"no bucket: each hive keeps its own list"
"no bucket: nothing was written"
);
// Control: a host does create it.
put(

24
swarm-controller/src/egress_allow.rs
View file

@ -5,8 +5,9 @@
//! (`swarm_wire::egress_allow`), which this daemon alone writes. Every hive
//! reads it and renders the entries for the agents it runs: a swarm-wide entry
//! joins the proxy's allow list for everyone, an entry with an agent is that
//! agent's alone. Once the key exists it replaces the list a hive's own nix
//! configuration names, so an empty list is a list.
//! agent's alone. A hive always allows the names its own nix configuration
//! lists (`services.hyperhive.squid.allowedDomains`) as well, so these entries
//! only add to them.
//!
//! Each name goes into the proxy's configuration, so it is checked here with
//! `swarm_wire::egress_allow::normalize_domain` (the hive checks again) and
@ -127,7 +128,7 @@ async fn open_or_create(
path = "/api/egress/allowed-domains",
responses(
(status = 200, description = "every entry, swarm-wide and per agent, sorted; empty \
when the swarm has not set a list, in which case each hive keeps its own",
when the swarm has not set a list",
body = AllowedDomains),
(status = 503, description = "no swarm queue is configured on this host, or it is \
not connected (problem+json)", body = String),
@ -154,10 +155,8 @@ pub(crate) async fn get_allowed_domains(
/// Allow one destination, for every agent or for one.
///
/// Adding an entry that is already there changes nothing. The first entry
/// makes the swarm's list replace each hive's own, so a name the hive's nix
/// configuration allows and this list lacks stops being allowed once hives read
/// it.
/// Adding an entry that is already there changes nothing. The entry adds to
/// the names each hive's nix configuration already allows.
#[utoipa::path(
post,
path = "/api/egress/allowed-domains",
@ -221,8 +220,8 @@ pub(crate) async fn add_allowed_domain(
/// Stop allowing one destination for the scope it was added with.
///
/// Removing an entry that is not there changes nothing. Removing the last one
/// leaves an empty list, which still replaces each hive's own.
/// Removing an entry that is not there changes nothing. A name a hive's nix
/// configuration lists stays allowed on that hive.
#[utoipa::path(
delete,
path = "/api/egress/allowed-domains",
@ -300,8 +299,7 @@ pub(crate) async fn current(client: &async_nats::Client) -> anyhow::Result<Optio
/// is written or `change` leaves it as it is. Answers whether a write landed.
///
/// A list that was never written is written only when `change` makes it
/// non-empty: the key's existence is what makes the swarm's list replace each
/// hive's own, so a change that adds nothing must not create it.
/// non-empty, so a change that adds nothing creates no bucket or key.
///
/// # Errors
/// A queue failure, or `MAX_ATTEMPTS` conflicting writes.
@ -541,7 +539,7 @@ mod tests {
assert_eq!(
published(&client).await.as_deref(),
Some(r#"{"entries":[]}"#),
"the last removal leaves an empty list, which still replaces a hive's own"
"the last removal leaves an empty list"
);
}
@ -578,7 +576,7 @@ mod tests {
}
/// A read before anything was added answers an empty list and creates no
/// bucket, so a hive keeps its own list.
/// bucket.
#[tokio::test]
async fn a_read_before_any_entry_answers_empty_and_creates_no_bucket() {
let nats = TestNats::start();