vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd

Browse source 
The dashboard, its API, the swagger UI and the agent routes move to their
own vhost, `swarm.dashboardDomain` = `<hive>.hives.<swarm.domain>`, under
the swarm domain so authelia's session cookie reaches it. `/`, `/api/` and
`/api/docs/` ask authelia through `auth_request`, and authelia's
`operatorsOnly` rule for each hive's dashboard name lets only the admins
group in. The hive domain keeps matrix discovery and redirects every other
path to the new name.

The name rides as a SAN on the hive's own gateway leaf: the per-hive bao
role allows it, and hive-tls asks for it and checks coverage.

HTTP Basic auth is gone: the htpasswd writer and its test, the
`hivectl gateway` verbs and host-socket requests, the `gateway.auth`
options (now a removed-option error), the unauthorized page and the bcrypt
dependency. tmpfiles deletes a leftover gateway.htpasswd, which held
bcrypt hashes at 0644.

c0re hands out dashboard and agent URLs on the new name
(HYPERHIVE_DASHBOARD_DOMAIN), and the swarm controller's hive roster
carries each hive's dashboard name for the swarm UI's hive list.

Closes #3469
This commit is contained in:
atlas 2026-10-15 20:19:23 +02:00 • committed by mara
commit 92559af8e7
47 changed files with 351 additions and 623 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/host-modules/swarm-authelia.nix
View file

@ -12,10 +12,9 @@
# `docs/swarm/sso.md` owns the role model — session provider always, OIDC
# provider derived from the client list — and the secrets map.
#
# Per-service integration — putting authelia's `auth_request` in front
# of the gateway's existing `auth_basic` locations — is deliberately NOT
# here. Standing an SSO provider up is reversible; cutting every
# operator-facing vhost over to it is not.
# Per-service integration — the `auth_request` in front of a vhost —
# lives in the module declaring that vhost. What lives here is the
# `access_control` rule each of them relies on.
{
pkgs,
lib,
@ -799,9 +798,8 @@ in
# STARTUP, so a mismatch is a container that refuses to boot rather
# than a login that misbehaves.
#
# ⚠️ And deliberately NO `dashboardAuth` here. That block is the
# gateway's `auth_basic`; applying it to the SSO provider would put
# the login page behind the login mechanism it exists to replace.
# ⚠️ And deliberately NO `auth_request` here: it would put the login
# page behind the login it serves.
services.nginx.virtualHosts."${cfg.domain}" = (gatewayCfg.lib.tlsFor cfg.domain) // {
listen = gatewayCfg.lib.listen;
extraConfig = gatewayCfg.lib.securityHeaders;
@ -1215,7 +1213,13 @@ in
# one, and without these rules any session passes it.
++ lib.optionals (swarmDomain != null) (operatorsOnly {
domain = hyperhiveCfg.swarm.bao.ui.domain;
});
})
# Every hive's dashboard, each on its own hive's host.
++ lib.optionals (swarmDomain != null) (
lib.concatMap (domain: operatorsOnly { inherit domain; }) (
lib.attrValues hyperhiveCfg.swarm.dashboardDomains
)
);
};
# The cookie domain is the SWARM's domain, NOT authelia's
@ -1227,13 +1231,9 @@ in
# setting both to the same host fails validation at startup
# rather than at first login.
#
# ⚠️ Known and accepted consequence while a hive keeps a
# domain outside the swarm's tree: this cookie is NOT sent
# to that hive's own surfaces (its dashboard), so SSO
# covers the swarm's services and not the hive's. It
# resolves when the hive domain moves under the swarm
# domain; until then it is a scope limit, not a bug to
# chase.
# Each hive's dashboard answers on `swarm.dashboardDomains`,
# under this domain, so the cookie reaches it whatever the
# hive's own domain is.
session.cookies = [
{
domain = cookieDomain;