From ba1d09639136e23b8ae04f4bc250a2b99560023a Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 1 Jun 2026 23:38:17 +0200 Subject: [PATCH] fix(gateway): interpolate actual htpasswdFile path in 401 page Per argus review: the hardcoded /etc/hyperhive/gateway.htpasswd example was wrong for operators with a custom htpasswdFile path. Move the unauthorized.html from the static agentErrorPagesDir derivation into a pkgs.writeText inside the lib.optionalAttrs guard where cfg.auth.htpasswdFile is in scope and statically known non-null. The rendered page now shows the operator's actual configured path. --- nix/modules/hive-gateway.nix | 74 ++++++++++++++++++++---------------- 1 file changed, 41 insertions(+), 33 deletions(-) diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index edae09a8..7ac6a439 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -59,32 +59,6 @@ let EOF - cat > $out/unauthorized.html <<'EOF' - - - - - unauthorized ◆ hyperhive - - - -

◆ unauthorized

-

This hive is protected by HTTP Basic auth. Valid credentials are required.

-

Operator: add a user with hivectl gateway create-user:

- 
hivectl gateway create-user \
-      --file /etc/hyperhive/gateway.htpasswd \
-      <username> --password-stdin
-

Then reload your browser and enter the credentials when prompted.

- - - EOF ''; in { @@ -629,13 +603,47 @@ in # Internal-only target for the 401 error_page above. # `internal` prevents direct client access; `alias` serves # the pre-built HTML from the Nix store. - "= /__hive_auth_unauthorized" = { - extraConfig = '' - internal; - alias ${agentErrorPagesDir}/unauthorized.html; - default_type text/html; - ''; - }; + # The page is built here (not in the top-level `let`) so + # that `cfg.auth.htpasswdFile` is in scope and known + # non-null — the operator sees the actual configured path + # in the `hivectl` example command, not a hardcoded guess. + "= /__hive_auth_unauthorized" = + let + htpasswdPath = cfg.auth.htpasswdFile; + page = pkgs.writeText "hive-gateway-unauthorized.html" '' + + + + + unauthorized ◆ hyperhive + + + +

◆ unauthorized

+

This hive is protected by HTTP Basic auth. Valid credentials are required.

+

Operator: add a user with hivectl gateway create-user:

+ 
hivectl gateway create-user \
+                          --file ${htpasswdPath} \
+                          <username> --password-stdin
+

Then reload your browser and enter the credentials when prompted.

+ + + ''; + in + { + extraConfig = '' + internal; + alias ${page}; + default_type text/html; + ''; + }; }; # Per-agent location blocks, generated at runtime by # hive-c0re and written to /var/lib/hyperhive/gateway/agents.conf