vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-forge: inline the webhook-host binding, used once

Browse source 
Her review: don't declare a `let` for a single use. The comment that justified
the binding moves to the use site and drops the claim it was carrying — that
`swarm.ui.domain` and `swarm.domain` can diverge — keeping only the part that
holds either way: this reads the same option swarm-controller builds its public
URL from, so the allow-list entry and the target it must match are one value
rather than two spellings.
This commit is contained in:
atlas 2026-08-31 18:26:34 +02:00
commit a44107c617
1 changed files with 7 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/host-modules/hive-forge/default.nix
View file

@ -9,13 +9,6 @@ let
gatewayCfg = config.services.hyperhive.gateway;
hyperhiveDomain = config.services.hyperhive.domain;
swarmDomain = config.services.hyperhive.swarm.domain;
# The host the swarm-controller's webhooks actually target. NOT
# `swarm.domain`: `swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL`
# from `swarm.ui.domain`, which merely *defaults* to the swarm domain and is
# documented as overridable. Reading the other one would be right until
# someone takes that option up, and then wrong in a way whose only symptom is
# a refused delivery.
swarmUiDomain = config.services.hyperhive.swarm.ui.domain;
tlsCfg = config.services.hyperhive.deploy.hive-controller.tls;
networkCfg = config.services.hyperhive.network;
@ -828,9 +821,12 @@ in
# deny '<swarm host>(10.42.0.1:443)' — webhook can only call
# allowed HTTP servers
#
# ⚠️ `swarm.ui.domain`, NOT `swarm.domain`: swarm-controller.nix
# builds its `SWARM_CONTROLLER_PUBLIC_URL` from the former, which
# only *defaults* to the latter and is documented as overridable.
# Read from `swarm.ui.domain` because that is the option
# `swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL`
# from. One value, two readers — an allow-list entry and the
# target it must match are two spellings of one address
# otherwise, and the failure is a delivery refused for a host
# nobody typed wrong.
#
# Not gated on `deploy.swarm-ui.enable`, even though that is what
# makes the controller register the hooks: in a spread deployment
@ -845,7 +841,7 @@ in
"external"
hyperhiveDomain
]
++ lib.optional (swarmDomain != null) swarmUiDomain
++ lib.optional (swarmDomain != null) config.services.hyperhive.swarm.ui.domain
)
);
log.LEVEL = "Warn";