vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move the squid host options to deploy.hive-controller.squid

Browse source
This commit is contained in:
atlas 2026-10-29 01:26:02 +01:00 • committed by mara
commit da16487800
7 changed files with 168 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

39
nix/host-modules/deploy.nix
View file

@ -254,6 +254,45 @@ in
[ "services" "hyperhive" "c0re" "adminUsers" ]
[ "services" "hyperhive" "deploy" "hive-controller" "adminUsers" ]
)
# The egress proxy runs only on a hive host, so its settings sit with the
# controller's. The read-only ones moved without a forward.
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "squid" "allowedDomains" ]
[ "services" "hyperhive" "deploy" "hive-controller" "squid" "allowedDomains" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "squid" "baseAllowedDomains" ]
[ "services" "hyperhive" "deploy" "hive-controller" "squid" "baseAllowedDomains" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "squid" "usersFile" ]
[ "services" "hyperhive" "deploy" "hive-controller" "squid" "usersFile" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "squid" "selfcheck" "unrestrictedCanary" ]
[
"services"
"hyperhive"
"deploy"
"hive-controller"
"squid"
"selfcheck"
"unrestrictedCanary"
]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "squid" "selfcheck" "canary" ]
[
"services"
"hyperhive"
"deploy"
"hive-controller"
"squid"
"selfcheck"
"canary"
]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "otel" "extraResourceAttributes" ]
[ "services" "hyperhive" "deploy" "hive-controller" "otel" "extraResourceAttributes" ]

2
nix/host-modules/hive-c0re/default.nix
View file

@ -349,7 +349,7 @@ in
# `-` so a host without the squid users directory still starts the daemon.
ReadWritePaths = [
"/var/lib/hive-gateway/conf"
"-${builtins.dirOf config.services.hyperhive.squid.usersFile}"
"-${builtins.dirOf config.services.hyperhive.deploy.hive-controller.squid.usersFile}"
];
ProtectKernelTunables = true; # no sysctl writes
ProtectKernelLogs = true; # no /dev/kmsg access needed

16
nix/host-modules/hive-c0re/environment.nix
View file

@ -290,21 +290,23 @@ in
# credentials for squid, and the list of the users whose agent holds the
# swarm's `unrestricted_internet` flag; it reads the credentials from the
# store under the identity above.
HIVE_SQUID_USERS_FILE = config.services.hyperhive.squid.usersFile;
HIVE_SQUID_UNRESTRICTED_FILE = config.services.hyperhive.squid.unrestrictedFile;
HIVE_SQUID_USERS_FILE = config.services.hyperhive.deploy.hive-controller.squid.usersFile;
HIVE_SQUID_UNRESTRICTED_FILE =
config.services.hyperhive.deploy.hive-controller.squid.unrestrictedFile;
# The swarm's egress allow-list, which `workers::squid_allow` renders into
# the two files; the seed is the list the files hold until the swarm has one,
# and the always-allowed names are those it never repeats.
HIVE_SQUID_ALLOWED_FILE = config.services.hyperhive.squid.allowedFile;
HIVE_SQUID_AGENT_ALLOW_FILE = config.services.hyperhive.squid.agentAllowFile;
HIVE_SQUID_ALLOWED_SEED_FILE = config.services.hyperhive.squid.allowedSeedFile;
HIVE_SQUID_ALWAYS_ALLOWED = lib.concatStringsSep " " config.services.hyperhive.squid.alwaysAllowed;
HIVE_SQUID_ALLOWED_FILE = config.services.hyperhive.deploy.hive-controller.squid.allowedFile;
HIVE_SQUID_AGENT_ALLOW_FILE = config.services.hyperhive.deploy.hive-controller.squid.agentAllowFile;
HIVE_SQUID_ALLOWED_SEED_FILE =
config.services.hyperhive.deploy.hive-controller.squid.allowedSeedFile;
HIVE_SQUID_ALWAYS_ALLOWED = lib.concatStringsSep " " config.services.hyperhive.deploy.hive-controller.squid.alwaysAllowed;
# The egress proxy facts every container is handed (`HiveFacts` in
# `hive-priv-sock`). They sit with the users file above because that is what
# makes squid's credential check and per-agent policy real on this host: an
# agent sends nothing through the proxy unless it reads both. Absent on a
# hive that predates them, so its agents go direct.
HIVE_SQUID_PROXY = config.services.hyperhive.squid.listen;
HIVE_SQUID_PROXY = config.services.hyperhive.deploy.hive-controller.squid.listen;
HIVE_EGRESS_NO_PROXY = lib.concatStringsSep "," egressDirectHosts;
}
// lib.optionalAttrs (haveBaoClientIdentity && baoDeploy.serverCaFile != null) {

2
nix/host-modules/hive-squid-credential.nix
View file

@ -28,7 +28,7 @@ let
&& tls.baoHiveIdentityCertFile != null
&& tls.baoHiveIdentityKeyFile != null;
credentialFile = "/run/credstore/${hyperhiveCfg.squid.selfcheck.credentialName}";
credentialFile = "/run/credstore/${hyperhiveCfg.deploy.hive-controller.squid.selfcheck.credentialName}";
storeRetry = import ./lib/store-retry.nix { };
storeRefreshTimer = import ./lib/store-refresh-timer.nix { };

6
nix/host-modules/hive-squid.nix
View file

@ -18,7 +18,7 @@
}:
let
hyperhiveCfg = config.services.hyperhive;
cfg = hyperhiveCfg.squid;
cfg = hyperhiveCfg.deploy.hive-controller.squid;
netCfg = hyperhiveCfg.network;
port = 3128;
@ -232,7 +232,7 @@ let
};
in
{
options.services.hyperhive.squid = {
options.services.hyperhive.deploy.hive-controller.squid = {
listen = lib.mkOption {
type = lib.types.str;
default = listen;
@ -492,7 +492,7 @@ in
{
assertion = !(builtins.elem cfg.selfcheck.unrestrictedCanary (allowed ++ base));
message = ''
services.hyperhive.squid.selfcheck.unrestrictedCanary must be a name outside
services.hyperhive.deploy.hive-controller.squid.selfcheck.unrestrictedCanary must be a name outside
allowedDomains and baseAllowedDomains, or the self-check cannot tell an unrestricted user from a
restricted one.
'';

2
nix/host-modules/lib/squid-base-domains.nix
View file

@ -1,4 +1,4 @@
# The default of `services.hyperhive.squid.baseAllowedDomains`, and the names
# The default of `services.hyperhive.deploy.hive-controller.squid.baseAllowedDomains`, and the names
# swarm-controller refuses as allow-list entries because squid already allows
# them to every authenticated user: the hosts Claude Code requires
# (<https://code.claude.com/docs/en/network-config>).

4
nix/host-modules/swarm-controller.nix
View file

@ -867,8 +867,8 @@ in
# The names squid allows every authenticated agent by default. The
# allow-list route refuses them as entries
# (swarm-controller/src/egress_allow.rs). A hive that overrides
# `squid.baseAllowedDomains` is not reflected here; its hive-c0re
# skips the entries its own list covers.
# `deploy.hive-controller.squid.baseAllowedDomains` is not reflected
# here; its hive-c0re skips the entries its own list covers.
SWARM_CONTROLLER_SQUID_BASE_DOMAINS = lib.concatStringsSep " " (
import ./lib/squid-base-domains.nix
);