vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

c0re: bind dashboard to 127.0.0.1 only (#652)

Browse source
This commit is contained in:
damocles 2026-05-30 19:29:27 +02:00 • committed by Mara
commit c5d466c5c5
2 changed files with 26 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nix/modules/hive-c0re.nix
View file

@ -194,21 +194,28 @@ in
managerToplevel
];
# Dashboard + per-container web UIs share the host's network namespace and
# need their ports reachable when there's no gateway in front. Dashboard:
# `cfg.dashboardPort` (default 7000). Manager: 8000. Sub-agents: 8100..8999
# (deterministic hash; see `lifecycle::agent_web_port`).
# Per-container web UIs share the host's network namespace and need
# their ports reachable when there's no gateway in front. Manager:
# 8000. Sub-agents: 8100..8999 (deterministic hash; see
# `lifecycle::agent_web_port`).
#
# The dashboard port (`cfg.dashboardPort`, default 7000) is *not*
# listed here — since #652 the dashboard binds `127.0.0.1` only,
# so opening the firewall hole would be a no-op. Remote dashboard
# access flows through hive-gateway (default-on); operators who
# opt out of the gateway lose external dashboard reach by design —
# the surface is privileged (approve / deny / destroy) and must
# not be exposed without a real reverse proxy in front.
#
# When `services.hyperhive.gateway.enable = true` (the default), the
# gateway nginx is the sole external entry point and proxies to
# `127.0.0.1:7000` etc. internally — leaving the direct ports open
# in the host firewall would defeat the gateway's "single front
# door" story (closes #621). Operators who opt out of the gateway
# still get the direct ports opened so the legacy
# `http://<host>:7000/` flow works.
# `127.0.0.1:7000` etc. internally — leaving the per-agent ports
# open in the host firewall would defeat the gateway's "single
# front door" story (closes #621). Operators who opt out of the
# gateway still get those direct ports opened so the legacy
# `http://<host>:8100/` flow works.
networking.firewall = lib.mkIf (!config.services.hyperhive.gateway.enable) {
allowedTCPPorts = [
cfg.dashboardPort
8000
];
allowedTCPPortRanges = [