vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

send agent traffic through squid once its hive announces it

Browse source
This commit is contained in:
atlas 2026-10-28 14:35:08 +01:00
commit b551eb02ff
1 changed files with 885 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nix/host-modules/hive-c0re/environment.nix
View file

@ -15,6 +15,30 @@ let
# sharing a host with the store. Deriving this from
# `deploy.bao.enable` would be the co-location assumption itself.
haveBaoClientIdentity = baoDeploy.clientCertFile != null && baoDeploy.clientKeyFile != null;
# What an agent reaches directly and never through squid. Squid refuses every
# destination that resolves to the bridge, and the hive's resolver answers the
# bridge address for the gateway's names, so each of these must skip it. A bare
# name matches itself and its subdomains in curl, Node and reqwest.
egressDirectHosts = lib.unique (
lib.filter (n: n != null && n != "") (
[
# Node's NO_PROXY has no CIDR support, so the bridge is listed as the address.
config.services.hyperhive.network.bridgeIp
# The hive's own zone, which dnsmasq answers with the bridge IP.
config.services.hyperhive.domain
# The mTLS store and the queue: not in `serviceDomains`.
config.services.hyperhive.swarm.bao.domain
config.services.hyperhive.swarm.nats.domain
]
# The swarm's apex (the swarm UI and the controller) and its forge, matrix,
# attic, logs, metrics and otel services, wherever they sit. The store and
# queue names are not in it, hence their lines above.
++ config.services.hyperhive.swarm.serviceDomains
# Every name this host's gateway answers with the bridge IP.
++ config.services.hyperhive.gateway.localNames
)
);
in
{
# nix (the prebuild `nix build`, flake-check, and meta eval) writes
@ -277,6 +301,13 @@ in
# store under the identity above.
HIVE_SQUID_USERS_FILE = config.services.hyperhive.squid.usersFile;
HIVE_SQUID_UNRESTRICTED_FILE = config.services.hyperhive.squid.unrestrictedFile;
# The egress proxy facts every container is handed (`HiveFacts` in
# `hive-priv-sock`). They sit with the users file above because that is what
# makes squid's credential check and per-agent policy real on this host: an
# agent sends nothing through the proxy unless it reads both. Absent on a
# hive that predates them, so its agents go direct.
HIVE_SQUID_PROXY = config.services.hyperhive.squid.listen;
HIVE_EGRESS_NO_PROXY = lib.concatStringsSep "," egressDirectHosts;
}
// lib.optionalAttrs (haveBaoClientIdentity && baoDeploy.serverCaFile != null) {
# Absent means the system trust store — right for a deployment with a real