From a3588893841f35f571439090f26bf66071fb9e16 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 19 Sep 2026 13:58:10 +0200 Subject: [PATCH] docs(gateway): describe nginx as per-host, not a deployment-wide singleton Fix wording flagged on #4521 review: "Single nginx in front of every hyperhive web surface" and "Runs on the host" claimed a deployment-wide topology. There's one nginx per host that has something on it, and potentially more inside service containers. Reword to describe what this module builds on this host, with no count claim swarm-wide. --- docs/networking/gateway.md | 2 +- nix/host-modules/hive-gateway/default.nix | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/networking/gateway.md b/docs/networking/gateway.md index 7fe765e1..5e175e1a 100644 --- a/docs/networking/gateway.md +++ b/docs/networking/gateway.md @@ -1,6 +1,6 @@ # hive-gateway -Single nginx in front of every hyperhive web surface. Runs on the **host**, next to hive-c0re, rather than in its own container: it shares the host netns anyway (see [Vhost map](#vhost-map) below), so containerizing it would buy no network isolation while costing a resolv.conf sync, a machine-bus reload, and three bind mounts. System-config (not meta-flake managed). Configured via `services.hyperhive.gateway.*` + per-subsystem opt-in flags in `services.hyperhive.{forge,matrix,...}`. `gateway.enable` and `gateway.dns.enable` are asserted by the modules that need them, so a host serving a vhost or resolving hive names gets them without an opt-in. +This host's nginx fronts the hyperhive web surfaces running on it — next to hive-c0re, not in its own container: it shares the host netns anyway (see [Vhost map](#vhost-map) below), so containerizing it would buy no network isolation while costing a resolv.conf sync, a machine-bus reload, and three bind mounts. System-config (not meta-flake managed). Configured via `services.hyperhive.gateway.*` + per-subsystem opt-in flags in `services.hyperhive.{forge,matrix,...}`. `gateway.enable` and `gateway.dns.enable` are asserted by the modules that need them, so a host serving a vhost or resolving hive names gets them without an opt-in. ## Vhost map diff --git a/nix/host-modules/hive-gateway/default.nix b/nix/host-modules/hive-gateway/default.nix index d0e74831..f3ff3863 100644 --- a/nix/host-modules/hive-gateway/default.nix +++ b/nix/host-modules/hive-gateway/default.nix @@ -1,7 +1,7 @@ -# Single nginx in front of every hyperhive web surface — dashboard, +# This host's nginx fronts the hyperhive web surfaces on it — dashboard, # per-agent UIs (sub-path), forge + matrix (sub-domain), .well-known -# delegations — plus the hive-internal dnsmasq resolver. Both run on the -# HOST, next to hive-c0re: nginx binds the host's :80/:443 and dnsmasq +# delegations — plus the hive-internal dnsmasq resolver. Both run on +# this host, next to hive-c0re: nginx binds :80/:443 and dnsmasq # answers on the hive bridge, so neither can be confined to a network # namespace of its own. # Full vhost map + discovery flow + design rationale in