vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move the hive's vhosts and matrix discovery out of the gateway

Browse source 
The dashboard vhost, the hive domain vhost and the dashboard's local
name move to hive-c0re/vhosts.nix; the matrix .well-known discovery and
the legacy /matrix/ redirect move to glue-matrix-hive-discovery.nix,
which adds them to the hive domain vhost. Both declare through
gateway.vhosts. hive-gateway/vhosts.nix keeps the catch-all only, and
the gateway no longer reads deploy.matrix or c0re.servedFrontend, nor
deploy.hive-controller.enable for its vhosts.

Part of #3742.
This commit is contained in:
atlas 2026-10-17 13:44:20 +02:00 • committed by mara
commit b4c5954491
17 changed files with 391 additions and 378 deletions
Download patch file Download diff file Expand all files Collapse all files

55
nix/host-modules/hive-gateway/default.nix
View file

@ -6,7 +6,7 @@
# namespace of its own.
# Full vhost map + discovery flow + design rationale in
# `docs/networking/gateway.md`. Layout: ./options.nix (option declarations),
# ./vhosts.nix (the gateway's own nginx virtual hosts), ./declared-vhosts.nix
# ./vhosts.nix (the catch-all `_` vhost), ./declared-vhosts.nix
# (renders the vhosts service modules declare under `gateway.vhosts`), ./error-pages.nix
# (styled static pages), ./dns.nix + ./dnsmasq.nix (the resolver, which
# has an enable of its own because a host can need hive names to resolve
@ -24,8 +24,6 @@ let
# cert are exactly the names that cert is issued for, so both read the
# same list rather than each deciding what "a swarm service" means.
swarmServiceDomains = config.services.hyperhive.swarm.serviceDomains;
matrixCfg = config.services.hyperhive.swarm.matrix;
matrixDeployCfg = config.services.hyperhive.deploy.matrix;
tlsStateDir = config.services.hyperhive.deploy.hive-controller.tls.stateDir;
# The hive leaf exists only where a hive runs; ../hive-tls.nix issues it
# under that same condition.
@ -48,16 +46,6 @@ let
lib.attrNames config.services.nginx.virtualHosts
);
# Dashboard SPA dist, static-served by nginx.
dashboardDist = "${config.services.hyperhive.c0re.servedFrontend}/dashboard";
# Full hyperhive-themed Swagger UI dist — nginx serves this whole
# tree straight from the store at /api/docs/, no hive-c0re fallback
# (see vhosts.nix's `swaggerUiLocations` and
# nix/packages/swagger-ui-{dist,theme}.nix). Own option under this
# module (not c0re's) — hive-c0re has no relationship to it.
swaggerUiTheme = cfg.swaggerUiTheme;
# Self-signed TLS is the implicit floor: when neither an operator cert
# (`tls.certDir`) nor ACME (`tls.acme.enable`) is configured, the gateway
# serves a leaf the secret store issues (see hive-tls.nix). There is no
@ -85,17 +73,15 @@ let
svcCert = "${tlsDir}/swarm-services.pem";
svcKey = "${tlsDir}/swarm-services-key.pem";
# Styled static error pages. Built once here and reached two ways:
# directly by ./vhosts.nix, and via the published kit by any service
# module that aims an `error_page` at one.
# Styled static error pages, reached through the published kit by any
# service module that aims an `error_page` at one.
errorPages = import ./error-pages.nix { inherit pkgs; };
# The vhost construction kit (listen set / per-name TLS attrs /
# security headers / error pages). Computed here, published as
# `cfg.lib` below, and handed to ./vhosts.nix **as the published
# value** — so the tree the gateway renders and the kit a service
# module gets are the same object by construction, not by two call
# sites agreeing.
# security headers / error pages). Computed here and published as
# `cfg.lib` below, which ./declared-vhosts.nix and every service module
# read, so the tree the gateway renders and the kit a service module
# gets are the same object by construction.
vhostLib = import ./vhost-lib.nix {
inherit
lib
@ -113,23 +99,6 @@ let
# per-container copy.
caBundle = "${config.services.hyperhive.deploy.hive-controller.tls.stateDir}/trust-bundle.pem";
};
ownVhosts = import ./vhosts.nix {
gwLib = cfg.lib;
inherit (config.services.hyperhive.swarm) dashboardDomain;
autheliaDomain = config.services.hyperhive.swarm.authelia.domain;
inherit
lib
cfg
errorPages
matrixCfg
matrixDeployCfg
hyperhiveDomain
runsHive
dashboardDist
swaggerUiTheme
;
};
in
{
imports = [
@ -145,8 +114,8 @@ in
# file's `let` and are not option surface.
services.hyperhive.gateway.lib = vhostLib;
# The gateway's own vhosts, rendered the way every service's are.
services.hyperhive.gateway.vhosts = ownVhosts.vhosts;
# The gateway's own vhost, rendered the way every service's are.
services.hyperhive.gateway.vhosts = import ./vhosts.nix;
assertions = [
{
@ -256,12 +225,6 @@ in
"r /var/lib/hive-gateway/conf/gateway.htpasswd"
];
# The dashboard's name, for agents on the bridge and (with
# `localHostsEntry`) the host's own browser.
services.hyperhive.gateway.localNames = lib.optional (
runsHive && config.services.hyperhive.swarm.dashboardDomain != null
) config.services.hyperhive.swarm.dashboardDomain;
# ACME (Let's Encrypt) integration. nginx vhosts set
# `enableACME = true` via the vhost builder; this provides the
# shared ACME config (acceptTerms + email).