gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd
The dashboard, its API, the swagger UI and the agent routes move to their own vhost, `swarm.dashboardDomain` = `<hive>.hives.<swarm.domain>`, under the swarm domain so authelia's session cookie reaches it. `/`, `/api/` and `/api/docs/` ask authelia through `auth_request`, and authelia's `operatorsOnly` rule for each hive's dashboard name lets only the admins group in. The hive domain keeps matrix discovery and redirects every other path to the new name. The name rides as a SAN on the hive's own gateway leaf: the per-hive bao role allows it, and hive-tls asks for it and checks coverage. HTTP Basic auth is gone: the htpasswd writer and its test, the `hivectl gateway` verbs and host-socket requests, the `gateway.auth` options (now a removed-option error), the unauthorized page and the bcrypt dependency. tmpfiles deletes a leftover gateway.htpasswd, which held bcrypt hashes at 0644. c0re hands out dashboard and agent URLs on the new name (HYPERHIVE_DASHBOARD_DOMAIN), and the swarm controller's hive roster carries each hive's dashboard name for the swarm UI's hive list. Closes #3469
This commit is contained in:
atlas
mara
parent
09ad7386b2
commit
92559af8e7
47 changed files with 351 additions and 623 deletions
|
|
@ -10,7 +10,7 @@ debug agent behavior.
|
|||
## For the operator
|
||||
|
||||
- **[hivectl](hivectl.md)** — the curated guide: provisioning forge
|
||||
and matrix accounts, gateway htpasswd management, container
|
||||
and matrix accounts, container
|
||||
lifecycle shortcuts, interactive agent shell access.
|
||||
- **[hivectl-cli](hivectl-cli.md)** — the exhaustive, autogenerated
|
||||
flag-by-flag reference, kept in lockstep with the binary by CI.
|
||||
|
|
|
|||
|
|
@ -9,10 +9,6 @@ This document contains the help content for the `hivectl` command-line program.
|
|||
* [`hivectl forge reconcile-config`↴](#hivectl-forge-reconcile-config)
|
||||
* [`hivectl matrix`↴](#hivectl-matrix)
|
||||
* [`hivectl matrix invite`↴](#hivectl-matrix-invite)
|
||||
* [`hivectl gateway`↴](#hivectl-gateway)
|
||||
* [`hivectl gateway create-user`↴](#hivectl-gateway-create-user)
|
||||
* [`hivectl gateway delete-user`↴](#hivectl-gateway-delete-user)
|
||||
* [`hivectl gateway list-users`↴](#hivectl-gateway-list-users)
|
||||
* [`hivectl agent`↴](#hivectl-agent)
|
||||
* [`hivectl agent restart`↴](#hivectl-agent-restart)
|
||||
* [`hivectl agent pause`↴](#hivectl-agent-pause)
|
||||
|
|
@ -57,7 +53,6 @@ Sibling to the `hive-c0re` daemon binary. Covers host-side admin operations that
|
|||
|
||||
* `forge` — Reconcile an agent's config between this hive and the forge
|
||||
* `matrix` — matrix-tuwunel invites
|
||||
* `gateway` — Gateway htpasswd user management
|
||||
* `agent` — Lifecycle actions on ONE managed agent container. Needs the hive-c0re daemon running
|
||||
* `list-agents` — Show all managed agents with their status and technical state
|
||||
* `quota-enable` — Enable btrfs qgroup accounting on the agent-state filesystem
|
||||
|
|
@ -147,61 +142,6 @@ Invite a matrix user to the hive Space, or a specific room with `--room`. Idempo
|
|||
|
||||
|
||||
|
||||
## `hivectl gateway`
|
||||
|
||||
Gateway htpasswd user management.
|
||||
|
||||
Add, remove, or list users for the gateway's HTTP Basic auth.
|
||||
|
||||
**Usage:** `hivectl gateway <COMMAND>`
|
||||
|
||||
###### **Subcommands:**
|
||||
|
||||
* `create-user` — Add a user or update an existing user's password in the gateway htpasswd
|
||||
* `delete-user` — Remove a user from the gateway htpasswd
|
||||
* `list-users` — List all gateway htpasswd usernames, one per line
|
||||
|
||||
|
||||
|
||||
## `hivectl gateway create-user`
|
||||
|
||||
Add a user or update an existing user's password in the gateway htpasswd.
|
||||
|
||||
Use `--password-stdin` to keep the password out of shell history.
|
||||
|
||||
**Usage:** `hivectl gateway create-user [OPTIONS] <USERNAME>`
|
||||
|
||||
###### **Arguments:**
|
||||
|
||||
* `<USERNAME>` — Username to add or update
|
||||
|
||||
###### **Options:**
|
||||
|
||||
* `--password <PASSWORD>` — Set the password inline. WARNING: visible in shell history and process listings — prefer `--password-stdin` for sensitive input. Mutually exclusive with `--password-stdin`
|
||||
* `--password-stdin` — Read the password from stdin (single line, trailing newline stripped). Mutually exclusive with `--password`
|
||||
|
||||
|
||||
|
||||
## `hivectl gateway delete-user`
|
||||
|
||||
Remove a user from the gateway htpasswd
|
||||
|
||||
**Usage:** `hivectl gateway delete-user <USERNAME>`
|
||||
|
||||
###### **Arguments:**
|
||||
|
||||
* `<USERNAME>` — Username to remove
|
||||
|
||||
|
||||
|
||||
## `hivectl gateway list-users`
|
||||
|
||||
List all gateway htpasswd usernames, one per line
|
||||
|
||||
**Usage:** `hivectl gateway list-users`
|
||||
|
||||
|
||||
|
||||
## `hivectl agent`
|
||||
|
||||
Lifecycle actions on ONE managed agent container. Needs the hive-c0re daemon running.
|
||||
|
|
@ -644,7 +584,7 @@ Resolves the URL from the running daemon so custom forge / matrix domains work.
|
|||
|
||||
Possible values:
|
||||
- `home`:
|
||||
The operator dashboard (`https://<domain>/`)
|
||||
The operator dashboard (`https://<hive>.hives.<swarm domain>/`)
|
||||
- `forge`:
|
||||
The forge (Forgejo) web UI
|
||||
- `matrix`:
|
||||
|
|
|
|||
|
|
@ -11,8 +11,7 @@ Available via the `hive-c0re` package in the host NixOS config.
|
|||
|
||||
Unlike the `hive-c0re` daemon subcommands (which go through the broker),
|
||||
`hivectl` covers direct host-side administration: manual provisioning of
|
||||
matrix accounts, gateway htpasswd management, container
|
||||
lifecycle shortcuts, and interactive agent shell access.
|
||||
matrix accounts, container lifecycle shortcuts, and interactive agent shell access.
|
||||
|
||||
This page is the curated guide. For the exhaustive flag-by-flag
|
||||
reference autogenerated from the binary's own command tree, see
|
||||
|
|
@ -65,25 +64,6 @@ group; nobody has built that sync yet.
|
|||
invite power (it owns the hive Space, so that case always works).
|
||||
Idempotent — already-member / already-invited is a no-op.
|
||||
|
||||
## Gateway
|
||||
|
||||
Manage users in the gateway's HTTP Basic auth htpasswd file
|
||||
(`services.hyperhive.gateway.auth`). `hivectl` sends the request over the
|
||||
host admin socket; the `hive-c0re` daemon owns the htpasswd file at its
|
||||
canonical path (`/var/lib/hive-gateway/conf/gateway.htpasswd`) and
|
||||
performs the write.
|
||||
|
||||
```bash
|
||||
hivectl gateway create-user alice --password-stdin # add (or update) user; read password from stdin
|
||||
hivectl gateway create-user bob --password hunter2 # add user inline (visible in shell history)
|
||||
hivectl gateway delete-user bob # remove user
|
||||
hivectl gateway list-users # list all usernames, one per line
|
||||
```
|
||||
|
||||
The daemon hashes passwords with BCrypt (cost 12). It creates the file
|
||||
if it doesn't exist. Re-running `create-user` with the same
|
||||
username updates the password hash in place.
|
||||
|
||||
## Agents
|
||||
|
||||
Container lifecycle shortcuts that go through the host admin socket.
|
||||
|
|
@ -229,7 +209,7 @@ Requires the `hive-c0re` daemon to be running.
|
|||
|
||||
```bash
|
||||
hivectl open # operator dashboard (same as `open home`)
|
||||
hivectl open home # operator dashboard (https://<domain>/)
|
||||
hivectl open home # operator dashboard (https://<hive>.hives.<swarm domain>/)
|
||||
hivectl open forge # the forge (Forgejo) web UI
|
||||
hivectl open matrix # the matrix GUI (fluffychat)
|
||||
```
|
||||
|
|
|
|||
Loading…
Reference in a new issue