vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd

Browse source 
The dashboard, its API, the swagger UI and the agent routes move to their
own vhost, `swarm.dashboardDomain` = `<hive>.hives.<swarm.domain>`, under
the swarm domain so authelia's session cookie reaches it. `/`, `/api/` and
`/api/docs/` ask authelia through `auth_request`, and authelia's
`operatorsOnly` rule for each hive's dashboard name lets only the admins
group in. The hive domain keeps matrix discovery and redirects every other
path to the new name.

The name rides as a SAN on the hive's own gateway leaf: the per-hive bao
role allows it, and hive-tls asks for it and checks coverage.

HTTP Basic auth is gone: the htpasswd writer and its test, the
`hivectl gateway` verbs and host-socket requests, the `gateway.auth`
options (now a removed-option error), the unauthorized page and the bcrypt
dependency. tmpfiles deletes a leftover gateway.htpasswd, which held
bcrypt hashes at 0644.

c0re hands out dashboard and agent URLs on the new name
(HYPERHIVE_DASHBOARD_DOMAIN), and the swarm controller's hive roster
carries each hive's dashboard name for the swarm UI's hive list.

Closes #3469
This commit is contained in:
atlas 2026-10-15 20:19:23 +02:00 • committed by mara
commit 92559af8e7
47 changed files with 351 additions and 623 deletions
Download patch file Download diff file Expand all files Collapse all files

62
docs/tools/hivectl-cli.md
View file

@ -9,10 +9,6 @@ This document contains the help content for the `hivectl` command-line program.
* [`hivectl forge reconcile-config`↴](#hivectl-forge-reconcile-config)
* [`hivectl matrix`↴](#hivectl-matrix)
* [`hivectl matrix invite`↴](#hivectl-matrix-invite)
* [`hivectl gateway`↴](#hivectl-gateway)
* [`hivectl gateway create-user`↴](#hivectl-gateway-create-user)
* [`hivectl gateway delete-user`↴](#hivectl-gateway-delete-user)
* [`hivectl gateway list-users`↴](#hivectl-gateway-list-users)
* [`hivectl agent`↴](#hivectl-agent)
* [`hivectl agent restart`↴](#hivectl-agent-restart)
* [`hivectl agent pause`↴](#hivectl-agent-pause)
@ -57,7 +53,6 @@ Sibling to the `hive-c0re` daemon binary. Covers host-side admin operations that
* `forge` — Reconcile an agent's config between this hive and the forge
* `matrix` — matrix-tuwunel invites
* `gateway` — Gateway htpasswd user management
* `agent` — Lifecycle actions on ONE managed agent container. Needs the hive-c0re daemon running
* `list-agents` — Show all managed agents with their status and technical state
* `quota-enable` — Enable btrfs qgroup accounting on the agent-state filesystem
@ -147,61 +142,6 @@ Invite a matrix user to the hive Space, or a specific room with `--room`. Idempo
## `hivectl gateway`
Gateway htpasswd user management.
Add, remove, or list users for the gateway's HTTP Basic auth.
**Usage:** `hivectl gateway <COMMAND>`
###### **Subcommands:**
* `create-user` — Add a user or update an existing user's password in the gateway htpasswd
* `delete-user` — Remove a user from the gateway htpasswd
* `list-users` — List all gateway htpasswd usernames, one per line
## `hivectl gateway create-user`
Add a user or update an existing user's password in the gateway htpasswd.
Use `--password-stdin` to keep the password out of shell history.
**Usage:** `hivectl gateway create-user [OPTIONS] <USERNAME>`
###### **Arguments:**
* `<USERNAME>` — Username to add or update
###### **Options:**
* `--password <PASSWORD>` — Set the password inline. WARNING: visible in shell history and process listings — prefer `--password-stdin` for sensitive input. Mutually exclusive with `--password-stdin`
* `--password-stdin` — Read the password from stdin (single line, trailing newline stripped). Mutually exclusive with `--password`
## `hivectl gateway delete-user`
Remove a user from the gateway htpasswd
**Usage:** `hivectl gateway delete-user <USERNAME>`
###### **Arguments:**
* `<USERNAME>` — Username to remove
## `hivectl gateway list-users`
List all gateway htpasswd usernames, one per line
**Usage:** `hivectl gateway list-users`
## `hivectl agent`
Lifecycle actions on ONE managed agent container. Needs the hive-c0re daemon running.
@ -644,7 +584,7 @@ Resolves the URL from the running daemon so custom forge / matrix domains work.
Possible values:
- `home`:
The operator dashboard (`https://<domain>/`)
The operator dashboard (`https://<hive>.hives.<swarm domain>/`)
- `forge`:
The forge (Forgejo) web UI
- `matrix`: