vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

gateway: scope bind-mount to gateway/ subdir, scrub #869 cookie (argus 🟡)

Browse source 
- gateway_nginx.rs: HOST_CONF_PATH → /var/lib/hyperhive/gateway/agents.conf
- hive-gateway.nix: hostPath = /var/lib/hyperhive/gateway (not whole parent
  dir — avoids exposing forge tokens or other credentials to the gateway
  container)
- tmpfiles: add /var/lib/hyperhive/gateway/ dir rule + seed agents.conf there
- scrub "(#869)" from hive-gateway-nginx-reload service description
This commit is contained in:
atlas 2026-05-31 20:18:14 +02:00 • committed by mara
commit 9eb8012c9b
2 changed files with 18 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hive-c0re/src/gateway_nginx.rs
View file

@ -30,12 +30,15 @@ use std::path::PathBuf;
use crate::agent_sockets;
use crate::lifecycle::{self, MANAGER_NAME};
const HOST_CONF_PATH: &str = "/var/lib/hyperhive/agents.conf";
const HOST_CONF_PATH: &str = "/var/lib/hyperhive/gateway/agents.conf";
/// Host-side path where c0re writes the generated nginx include file.
/// The gateway container bind-mounts `/var/lib/hyperhive/` at
/// `/run/hive-state/` so nginx inside can read it at
/// `/run/hive-state/agents.conf`.
/// The gateway container bind-mounts `/var/lib/hyperhive/gateway/`
/// (not the whole parent dir) at `/run/hive-state/` so nginx inside
/// can read it at `/run/hive-state/agents.conf`. Subdirectory scoping
/// avoids exposing the rest of `/var/lib/hyperhive/` (which may contain
/// forge tokens or other credentials) to the gateway container (argus 🟡
/// on #872).
#[must_use]
pub fn host_conf_path() -> PathBuf {
PathBuf::from(HOST_CONF_PATH)

21
nix/modules/hive-gateway.nix
View file

@ -228,7 +228,8 @@ in
systemd.tmpfiles.rules = [
"d /run/hive-agent 0755 root root - -"
"d /var/lib/hyperhive 0755 root root - -"
"f /var/lib/hyperhive/agents.conf 0644 root root - # Generated by hive-c0re — do not edit.\n"
"d /var/lib/hyperhive/gateway 0755 root root - -"
"f /var/lib/hyperhive/gateway/agents.conf 0644 root root - # Generated by hive-c0re — do not edit.\n"
];
containers.hive-gateway = {
@ -248,15 +249,15 @@ in
hostPath = "/run/hive-agent";
isReadOnly = true;
};
# Bind-mount the hyperhive state dir so nginx can include the
# runtime-generated agents.conf. Read-only; c0re writes
# /var/lib/hyperhive/agents.conf on the host and the systemd
# path unit inside the container triggers nginx -s reload on
# each atomic rename (#869). Pre-created by a tmpfiles rule so
# nspawn always finds the source at boot (c0re also writes it
# on first startup, but the container may start before c0re).
# Bind-mount ONLY the gateway-specific subdir of the hyperhive
# state dir. Scoped to /var/lib/hyperhive/gateway/ rather than
# the whole parent so the gateway container can't read forge
# tokens or other files that may live at the parent level (argus
# 🟡 on #872). c0re writes agents.conf under this subdir;
# the systemd path unit inside the container fires nginx -s reload
# on each atomic rename. Pre-created by a tmpfiles rule.
bindMounts."/run/hive-state" = {
hostPath = "/var/lib/hyperhive";
hostPath = "/var/lib/hyperhive/gateway";
isReadOnly = true;
};
config =
@ -408,7 +409,7 @@ in
};
systemd.services.hive-gateway-nginx-reload = {
description = "Reload nginx after agents.conf change (#869)";
description = "Reload nginx after agents.conf change";
# Don't block any target — fires only when the path unit
# triggers it.
serviceConfig = {