vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd

Browse source 
The dashboard, its API, the swagger UI and the agent routes move to their
own vhost, `swarm.dashboardDomain` = `<hive>.hives.<swarm.domain>`, under
the swarm domain so authelia's session cookie reaches it. `/`, `/api/` and
`/api/docs/` ask authelia through `auth_request`, and authelia's
`operatorsOnly` rule for each hive's dashboard name lets only the admins
group in. The hive domain keeps matrix discovery and redirects every other
path to the new name.

The name rides as a SAN on the hive's own gateway leaf: the per-hive bao
role allows it, and hive-tls asks for it and checks coverage.

HTTP Basic auth is gone: the htpasswd writer and its test, the
`hivectl gateway` verbs and host-socket requests, the `gateway.auth`
options (now a removed-option error), the unauthorized page and the bcrypt
dependency. tmpfiles deletes a leftover gateway.htpasswd, which held
bcrypt hashes at 0644.

c0re hands out dashboard and agent URLs on the new name
(HYPERHIVE_DASHBOARD_DOMAIN), and the swarm controller's hive roster
carries each hive's dashboard name for the swarm UI's hive list.

Closes #3469
This commit is contained in:
atlas 2026-10-15 20:19:23 +02:00 • committed by mara
commit 92559af8e7
47 changed files with 351 additions and 623 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/host-modules/swarm-ui.nix
View file

@ -1,6 +1,6 @@
# The swarm-level web UI: a static bundle served by the gateway's nginx,
# behind authelia. Distinct from the per-hive dashboard (hive-c0re's, on
# the hive domain) — this one answers for the swarm apex and is the
# `swarm.dashboardDomain`) — this one answers for the swarm apex and is the
# operator's view across hives.
#
# Options only. The vhost itself is declared in hive-gateway/vhosts.nix
@ -105,19 +105,20 @@ in
config = lib.mkIf deployCfg.swarm-controller.enable {
assertions = [
{
# The `_` default server already answers for the hive domain
# (dashboard, per-agent routes). A second vhost claiming the same
# The hive domain has its own vhost (matrix discovery, the redirect
# to the dashboard). A second vhost claiming the same
# server_name is not an error to nginx — it picks one and logs a
# conflict — so the failure would surface as "the dashboard is
# sometimes the swarm UI", which is far harder to read than an
# conflict — so the failure would surface as "the swarm UI is
# sometimes a redirect", which is far harder to read than an
# eval failure naming both options.
assertion = apex != hiveDomain;
message = ''
services.hyperhive.swarm.domain (${apex}) must differ from
services.hyperhive.domain (${hiveDomain}) — the hive domain is
already served by the gateway's default vhost (dashboard +
agent routes), and two vhosts claiming one server_name
silently resolve to whichever nginx picks.
already served by the gateway's own vhost for it (matrix
discovery, the redirect to the dashboard), and two vhosts
claiming one server_name silently resolve to whichever nginx
picks.
Set services.hyperhive.swarm.domain to a name distinct from
this hive's.
@ -154,8 +155,7 @@ in
}
];
# The swarm's front page, and the FIRST `auth_request` anywhere in
# this gateway (everything else is `auth_basic` + htpasswd).
# The swarm's front page.
#
# ⚠️ `auth_request` answers "is there a session", not "is this an
# operator". The operator-only part is authelia's `access_control`