From a44107c617e61cfa2021c313206a3401c8d3abf1 Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 31 Aug 2026 18:26:34 +0200 Subject: [PATCH] hive-forge: inline the webhook-host binding, used once MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Her review: don't declare a `let` for a single use. The comment that justified the binding moves to the use site and drops the claim it was carrying — that `swarm.ui.domain` and `swarm.domain` can diverge — keeping only the part that holds either way: this reads the same option swarm-controller builds its public URL from, so the allow-list entry and the target it must match are one value rather than two spellings. --- nix/host-modules/hive-forge/default.nix | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index beb1a826..16909551 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -9,13 +9,6 @@ let gatewayCfg = config.services.hyperhive.gateway; hyperhiveDomain = config.services.hyperhive.domain; swarmDomain = config.services.hyperhive.swarm.domain; - # The host the swarm-controller's webhooks actually target. NOT - # `swarm.domain`: `swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL` - # from `swarm.ui.domain`, which merely *defaults* to the swarm domain and is - # documented as overridable. Reading the other one would be right until - # someone takes that option up, and then wrong in a way whose only symptom is - # a refused delivery. - swarmUiDomain = config.services.hyperhive.swarm.ui.domain; tlsCfg = config.services.hyperhive.deploy.hive-controller.tls; networkCfg = config.services.hyperhive.network; @@ -828,9 +821,12 @@ in # deny '(10.42.0.1:443)' — webhook can only call # allowed HTTP servers # - # ⚠️ `swarm.ui.domain`, NOT `swarm.domain`: swarm-controller.nix - # builds its `SWARM_CONTROLLER_PUBLIC_URL` from the former, which - # only *defaults* to the latter and is documented as overridable. + # Read from `swarm.ui.domain` because that is the option + # `swarm-controller.nix` builds `SWARM_CONTROLLER_PUBLIC_URL` + # from. One value, two readers — an allow-list entry and the + # target it must match are two spellings of one address + # otherwise, and the failure is a delivery refused for a host + # nobody typed wrong. # # Not gated on `deploy.swarm-ui.enable`, even though that is what # makes the controller register the hooks: in a spread deployment @@ -845,7 +841,7 @@ in "external" hyperhiveDomain ] - ++ lib.optional (swarmDomain != null) swarmUiDomain + ++ lib.optional (swarmDomain != null) config.services.hyperhive.swarm.ui.domain ) ); log.LEVEL = "Warn";