vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

route gateway htpasswd management through a daemon wire command (#2504)

Browse source
This commit is contained in:
damocles 2026-07-15 23:18:11 +02:00 • committed by mara
commit f1812335d1
9 changed files with 181 additions and 160 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/gateway.md
View file

@ -485,8 +485,9 @@ is required. The file is exposed inside the gateway container at
`/run/hive-state/gateway.htpasswd` via the existing gateway state
bind-mount.
Manage users with `hivectl gateway` (defaults to the standard path — no
`--file` flag needed for the common case):
Manage users with `hivectl gateway`. `hivectl` sends the request over the
host admin socket and the `hive-c0re` daemon performs the write at its
canonical path — no path is exposed to the CLI:
```sh
# Add or update a user (prompted for password):
@ -502,10 +503,9 @@ hivectl gateway delete-user bob
hivectl gateway list-users
```
`hivectl gateway create-user` hashes passwords with BCrypt (cost 12) and
writes `$2y$`-prefixed hashes that nginx accepts natively. No external
`htpasswd` binary is required. Pass `--file <path>` to target a
non-default file.
The daemon hashes passwords with BCrypt (cost 12) and writes
`$2y$`-prefixed hashes that nginx accepts natively. No external
`htpasswd` binary is required.
**What is not gated:** per-agent UI routes emitted into `agents.conf`
(served under `/agent/<name>/`) inherit no auth from `/` — nginx

29
docs/tools/hivectl-cli.md
View file

@ -249,17 +249,17 @@ Gateway htpasswd user management. Add, remove, or list users in an htpasswd file
###### **Subcommands:**
* `create-user` — Add a new user or update the password of an existing user in the gateway htpasswd file. The password is hashed with `BCrypt` (cost 12)
* `create-user` — Add a new user or update the password of an existing user in the gateway htpasswd file. The daemon bcrypt-hashes the password (cost 12) and writes the credential store — hivectl relays over the host socket and never touches the file
* `delete-user` — Remove a user from the gateway htpasswd file. Exits with an error when the user is not found so callers can detect the no-op case
* `list-users` — List all usernames in the gateway htpasswd file, one per line
* `list-users` — List all gateway htpasswd usernames, one per line
## `hivectl gateway create-user`
Add a new user or update the password of an existing user in the gateway htpasswd file. The password is hashed with `BCrypt` (cost 12).
Add a new user or update the password of an existing user in the gateway htpasswd file. The daemon bcrypt-hashes the password (cost 12) and writes the credential store — hivectl relays over the host socket and never touches the file.
Pass `--password-stdin` when scripting or when you don't want the password visible in shell history. The file is created if it does not exist; its parent directory must already exist.
Pass `--password-stdin` when scripting or when you don't want the password visible in shell history.
**Usage:** `hivectl gateway create-user [OPTIONS] <USERNAME>`
@ -271,9 +271,6 @@ Pass `--password-stdin` when scripting or when you don't want the password visib
* `--password <PASSWORD>` — Set the password inline. WARNING: visible in shell history and process listings — prefer `--password-stdin` for sensitive input. Mutually exclusive with `--password-stdin`
* `--password-stdin` — Read the password from stdin (single line, trailing newline stripped). Mutually exclusive with `--password`
* `-f`, `--file <FILE>` — Path to the htpasswd file. Defaults to the standard gateway credential store at `/var/lib/hyperhive/gateway/gateway.htpasswd`
Default value: `/var/lib/hyperhive/gateway/gateway.htpasswd`
@ -281,31 +278,19 @@ Pass `--password-stdin` when scripting or when you don't want the password visib
Remove a user from the gateway htpasswd file. Exits with an error when the user is not found so callers can detect the no-op case
**Usage:** `hivectl gateway delete-user [OPTIONS] <USERNAME>`
**Usage:** `hivectl gateway delete-user <USERNAME>`
###### **Arguments:**
* `<USERNAME>` — Username to remove
###### **Options:**
* `-f`, `--file <FILE>` — Path to the htpasswd file. Defaults to the standard gateway credential store
Default value: `/var/lib/hyperhive/gateway/gateway.htpasswd`
## `hivectl gateway list-users`
List all usernames in the gateway htpasswd file, one per line
List all gateway htpasswd usernames, one per line
**Usage:** `hivectl gateway list-users [OPTIONS]`
###### **Options:**
* `-f`, `--file <FILE>` — Path to the htpasswd file. Defaults to the standard gateway credential store
Default value: `/var/lib/hyperhive/gateway/gateway.htpasswd`
**Usage:** `hivectl gateway list-users`

13
docs/tools/hivectl.md
View file

@ -98,9 +98,10 @@ hivectl github set-token damocles --token <pat> # inline (visible in shell hi
## Gateway
Manage users in the gateway's HTTP Basic auth htpasswd file
(`services.hyperhive.gateway.auth`). All commands default to
`/var/lib/hyperhive/gateway/gateway.htpasswd`; pass `--file` to target
a different path.
(`services.hyperhive.gateway.auth`). `hivectl` sends the request over the
host admin socket; the `hive-c0re` daemon owns the htpasswd file at its
canonical path (`/var/lib/hyperhive/gateway/gateway.htpasswd`) and
performs the write.
```bash
hivectl gateway create-user alice --password-stdin # add (or update) user; read password from stdin
@ -109,9 +110,9 @@ hivectl gateway delete-user bob # remove user
hivectl gateway list-users # list all usernames, one per line
```
Passwords are hashed with BCrypt (cost 12). The file is created if it
does not exist. Re-running `create-user` with the same username updates
the password hash in place.
Passwords are hashed with BCrypt (cost 12) by the daemon. The file is
created if it does not exist. Re-running `create-user` with the same
username updates the password hash in place.
## Agents