vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nix(c0re): set HIVE_FORGE_URL to the gateway URL directly, drop dead if/else

Browse source 
Per mara's review of #1718: this env block only exists when hyperhive is
enabled (it lives inside `config = mkIf cfg.enable`), so the
`if hyperhive.enable then gateway else loopback` branch was dead — the
loopback fallback could never be reached. Set HIVE_FORGE_URL to the
gateway vhost directly.

HIVE_MATRIX_URL drops the same redundant `hyperhive.enable` term but
keeps the gatewayHost null-guard — that one is a real fallback for a
domain-less config, not the dead enable branch.
This commit is contained in:
atlas 2026-06-17 16:56:26 +02:00
commit e8c2ef087c
1 changed files with 15 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

42
nix/modules/hive-c0re.nix
View file

@ -750,38 +750,26 @@ in
HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarmName;
}
// lib.optionalAttrs config.services.hyperhive.forge.enable {
# In-cluster forge URL.
# - Isolated (private netns): containers resolve `forge.<domain>` via
# the bridge dnsmasq and reach nginx on port 80. No raw forge port
# needed — nginx proxies to forgejo as it does for the operator.
# - Shared netns: host loopback is reachable, use direct port.
# In-cluster forge URL. Network isolation is unconditional (the
# shared-netns mode was removed), so agents always resolve
# `forge.<domain>` via the bridge dnsmasq and reach nginx on port 80
# (nginx proxies to forgejo as it does for the operator) — there is
# no host-loopback path. This env is only set when hyperhive is
# enabled, so the gateway URL is unconditionally correct here.
# See `docs/gateway.md::HIVE_FORGE_URL`.
# Network isolation is now unconditional (the shared-netns mode was
# removed), so agents always reach the forge through the gateway
# vhost rather than host loopback. Guard on the top-level
# `hyperhive.enable` (not the deprecated `network.enable`): the
# network is always on with hyperhive, so the deprecated toggle has
# no effect here either — the loopback branch only covers a config
# with hyperhive itself disabled (no agents to serve).
HIVE_FORGE_URL =
if config.services.hyperhive.enable then
"http://${config.services.hyperhive.forge.domain}"
else
"http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}";
HIVE_FORGE_URL = "http://${config.services.hyperhive.forge.domain}";
}
// lib.optionalAttrs config.services.hyperhive.matrix.enable {
# In-cluster matrix homeserver URL for each agent's
# hive-matrix-daemon. Same shape + rationale as HIVE_FORGE_URL:
# network isolation is now unconditional, so agents reach tuwunel
# via the gateway vhost (`matrix.<domain>`) on plain http:80 rather
# than host loopback. Guard on the top-level `hyperhive.enable` (the
# deprecated `network.enable` has no effect); the gatewayHost
# null-guard falls back to loopback so a domain-less config still
# evals. Forwarded to agents by meta.rs alongside HIVE_FORGE_URL;
# shares the same env-forwarding ordering caveat (value baked at
# config-generation time).
# hive-matrix-daemon — the gateway vhost (`matrix.<domain>`) on plain
# http:80. Network isolation is unconditional, so there is no
# host-loopback path; the only remaining conditional is the
# gatewayHost null-guard, which falls back to loopback so a
# domain-less config still evals. Forwarded to agents by meta.rs
# alongside HIVE_FORGE_URL; shares the same env-forwarding ordering
# caveat (value baked at config-generation time).
HIVE_MATRIX_URL =
if config.services.hyperhive.enable && config.services.hyperhive.matrix.gatewayHost != null then
if config.services.hyperhive.matrix.gatewayHost != null then
"http://${config.services.hyperhive.matrix.gatewayHost}"
else
"http://127.0.0.1:${toString config.services.hyperhive.matrix.httpPort}";