vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

gateway: scope bind-mount to gateway/ subdir, scrub #869 cookie (argus 🟡)

Browse source 
- gateway_nginx.rs: HOST_CONF_PATH → /var/lib/hyperhive/gateway/agents.conf
- hive-gateway.nix: hostPath = /var/lib/hyperhive/gateway (not whole parent
  dir — avoids exposing forge tokens or other credentials to the gateway
  container)
- tmpfiles: add /var/lib/hyperhive/gateway/ dir rule + seed agents.conf there
- scrub "(#869)" from hive-gateway-nginx-reload service description
This commit is contained in:
atlas 2026-05-31 20:18:14 +02:00 • committed by mara
commit 9eb8012c9b
2 changed files with 18 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hive-c0re/src/gateway_nginx.rs
View file

@ -30,12 +30,15 @@ use std::path::PathBuf;
use crate::agent_sockets;
use crate::lifecycle::{self, MANAGER_NAME};
const HOST_CONF_PATH: &str = "/var/lib/hyperhive/agents.conf";
const HOST_CONF_PATH: &str = "/var/lib/hyperhive/gateway/agents.conf";
/// Host-side path where c0re writes the generated nginx include file.
/// The gateway container bind-mounts `/var/lib/hyperhive/` at
/// `/run/hive-state/` so nginx inside can read it at
/// `/run/hive-state/agents.conf`.
/// The gateway container bind-mounts `/var/lib/hyperhive/gateway/`
/// (not the whole parent dir) at `/run/hive-state/` so nginx inside
/// can read it at `/run/hive-state/agents.conf`. Subdirectory scoping
/// avoids exposing the rest of `/var/lib/hyperhive/` (which may contain
/// forge tokens or other credentials) to the gateway container (argus 🟡
/// on #872).
#[must_use]
pub fn host_conf_path() -> PathBuf {
PathBuf::from(HOST_CONF_PATH)