vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: follow the swarm service names to the swarm domain

Browse source 
The three moves above falsify prose in five files, and none of it is
caught by a gate: clippy, cargo test and nix flake check read exactly
zero markdown.

Corrected where a doc stated a DEFAULT or enumerated the vhosts --
gateway (ACME requirements + the header table + the two Forgejo
reachability lines), matrix (gatewayHost, firewall rationale, agent
reachability), network (container table + the HTTP resolution bullet),
turn-loop config, dashboard.

Two mentions are deliberately left alone. `docs/tools/hivectl.md` says
the URL is read from the daemon "instead of assuming forge.<domain>" --
that sentence is about not assuming a shape and stays true. And
matrix.md's breaking-change note describes what `serverName` USED to
default to; it is history, correctly labelled, and rewriting it would
erase the record of an earlier migration.

The ACME line gained a requirement rather than a rename: with the
service names under the swarm domain, every one of those names has to
resolve to this host, not just the hive's own.
This commit is contained in:
atlas 2026-08-05 23:30:53 +02:00 • committed by mara
commit a1243fe04a
5 changed files with 24 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/matrix.md
View file

@ -18,7 +18,7 @@ Same shape as [`gateway.md::hive-forge container shape`](gateway.md):
separate state dir.
- Container shares the host network namespace
(`privateNetwork = false`) for state + systemd-unit isolation. Agents
reach the homeserver at `matrix.<domain>` via the gateway (agents
reach the homeserver at `chat.<swarm-domain>` via the gateway (agents
run in private netns and can't access host loopback directly).
- Persistent state at
`/var/lib/nixos-containers/hive-matrix/var/lib/matrix-tuwunel/`
@ -38,9 +38,17 @@ Two distinct hostnames:
the hive-gateway serves at that domain.
- **`gatewayHost`** — the API listener hostname, where the gateway's
matrix vhost proxies `/_matrix/*` to tuwunel. Defaults to
`matrix.<services.hyperhive.domain>` (sub-domain shape). Set to
`null` to skip the gateway vhost (tuwunel stays direct on
`httpPort`).
`chat.<services.hyperhive.swarm.domain>` — the **swarm's** domain,
because a swarm runs one homeserver. Set to `null` to skip the
gateway vhost (tuwunel stays direct on `httpPort`).
⚠️ Only this one moved. `serverName` still defaults to the bare hive
domain, and the two are independent by design: `gatewayHost` is a
routing detail clients rediscover through `.well-known`, while
`serverName` is baked into every user and room id. A deployment that
wants its old API hostname pins
`gatewayHost = "matrix.<hive-domain>"` — exactly what the previous
default rendered.
**Breaking change**: `serverName` used to default to
`matrix.${services.hyperhive.domain}`. Existing homeservers must set
@ -53,7 +61,7 @@ sub-domain from the user-facing identifier.
`openFirewall` defaults to `false` (secure-by-default): the host
reaches the homeserver on loopback, and agent containers reach it
at `matrix.<domain>` via the gateway — so the firewall hole only
at `chat.<swarm-domain>` via the gateway — so the firewall hole only
matters for access from *outside* the host. Flip to `true` when
announcing the homeserver to other hives or when an external matrix
client needs to reach the client-server API directly.