docs(3191): the gateway's comments describe a host service, not a container
Prose-only sweep of every remaining claim that nginx or dnsmasq lives in a container: the port comment (root in a container -> root on the host), upstreamHost's netns rationale, the ACME state dir, the store path reachability note, the vhost tree header, dnsmasq's resolv.conf paragraph (there is no copy and no path unit watching it any more), the two hive-network bridge comments, and swarm-controller's socket access-control note, which described a bind-mount that no longer exists. No behaviour change; all of it was describing a mechanism that was deleted.
This commit is contained in:
atlas
parent
d70b1e0a97
commit
f85724a638
7 changed files with 54 additions and 59 deletions
|
|
@ -26,9 +26,7 @@ let
|
|||
forgeCfg = config.services.hyperhive.swarm.forge;
|
||||
networkCfg = config.services.hyperhive.network;
|
||||
|
||||
# Dashboard SPA dist, static-served by nginx. Read in OUTER scope so
|
||||
# `config` is the host's (inside the container block it'd be the
|
||||
# container's).
|
||||
# Dashboard SPA dist, static-served by nginx.
|
||||
dashboardDist = "${config.services.hyperhive.c0re.servedFrontend}/dashboard";
|
||||
|
||||
# Full hyperhive-themed Swagger UI dist — nginx serves this whole
|
||||
|
|
@ -243,10 +241,10 @@ in
|
|||
# mode behind.
|
||||
chmod 0755 ${builtins.dirOf tlsDir}
|
||||
chmod 0755 ${tlsDir}
|
||||
# Copy the host leaf in. `install` writes atomically with the
|
||||
# target mode; run as root (container root == host root,
|
||||
# privateUsers=false) so the 0600 root:root host key is
|
||||
# readable. Key ends up root:nginx 0640 so nginx-pre-start
|
||||
# Copy the leaf in. `install` writes atomically with the
|
||||
# target mode; runs as root so the 0600 root:root key written
|
||||
# by hive-tls-ca is readable. Key ends up root:nginx 0640 so
|
||||
# nginx-pre-start
|
||||
# (which runs `nginx -t` as the nginx user, not root) can
|
||||
# read it — a 0600 root:root key passes the master load but
|
||||
# fails the pre-start config test with `BIO_new_file() …
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
# Hive-internal DNS resolver + DHCP, co-located in the gateway
|
||||
# container — single front-door for both DNS and HTTP, saves a
|
||||
# sibling container. Listens on the bridge interface from
|
||||
# Hive-internal DNS resolver + DHCP, running on the host alongside the
|
||||
# gateway's nginx — single front-door for both DNS and HTTP, and no
|
||||
# container of its own. Listens on the bridge interface from
|
||||
# `services.hyperhive.network`; authoritative for the hive domain +
|
||||
# sub-domains, forwards everything else upstream. Returns the
|
||||
# `services.dnsmasq` value for the container config (see
|
||||
# ./default.nix); the DHCP pool bounds are computed by hive-network.
|
||||
# `services.dnsmasq` value (see ./default.nix); the DHCP pool bounds
|
||||
# are computed by hive-network.
|
||||
{
|
||||
lib,
|
||||
networkCfg,
|
||||
|
|
@ -68,14 +68,13 @@
|
|||
dhcp-range = "${networkCfg.dhcpRangeStart},${networkCfg.dhcpRangeEnd},1h";
|
||||
dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
|
||||
# No explicit upstream: non-hive queries follow dnsmasq's
|
||||
# resolv.conf default — the gateway container's `/etc/resolv.conf`,
|
||||
# which nixos-container copies from the host at every start, so the
|
||||
# hive always uses the host's resolvers. resolvconf is disabled in
|
||||
# the container (see ./default.nix) so nothing regenerates that
|
||||
# copy; the host-side `hive-gateway-resolv` path unit (also in
|
||||
# ./default.nix) pushes in a fresh copy and reloads dnsmasq whenever
|
||||
# the host's resolvers change, so the copy can't go stale under a
|
||||
# network switch. Deliberately no fallback `server=`: dnsmasq queries
|
||||
# resolv.conf default — the host's own `/etc/resolv.conf`, so the
|
||||
# hive always uses the host's resolvers and follows them live. This
|
||||
# used to be a *copy* nixos-container made at container start, kept
|
||||
# fresh by a host-side path unit that pushed in a new one and
|
||||
# reloaded dnsmasq; running on the host deleted both the copy and
|
||||
# the machinery that watched it. Deliberately no fallback
|
||||
# `server=`: dnsmasq queries
|
||||
# all known upstreams in parallel, so a hardcoded public resolver
|
||||
# would take a share of *normal* traffic, not just fill in when the
|
||||
# host file is empty.
|
||||
|
|
|
|||
|
|
@ -28,10 +28,10 @@ in
|
|||
example = 8080;
|
||||
description = ''
|
||||
TCP port the gateway listens on. Default 80 (canonical web
|
||||
port). nginx inside the container binds <1024 because the
|
||||
container's init runs as root; if 80 is already taken on the
|
||||
host (existing nginx, traefik, etc.) override to an unused
|
||||
port like 8080 or move the conflicting service.
|
||||
port). nginx runs on the host as root, so it can bind <1024;
|
||||
if 80 is already taken on the host (existing nginx, traefik,
|
||||
etc.) override to an unused port like 8080 or move the
|
||||
conflicting service.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -40,8 +40,8 @@ in
|
|||
default = "127.0.0.1";
|
||||
description = ''
|
||||
Host the gateway proxies non-static requests to. Defaults to
|
||||
`127.0.0.1` because the gateway container shares the host
|
||||
netns, so loopback resolves directly to hive-c0re.
|
||||
`127.0.0.1` because nginx runs on the host itself, so loopback
|
||||
resolves directly to hive-c0re.
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
@ -180,11 +180,11 @@ in
|
|||
default = false;
|
||||
example = true;
|
||||
description = ''
|
||||
Let nginx inside the gateway container obtain and renew TLS
|
||||
certificates automatically via ACME (Let's Encrypt). When
|
||||
enabled, each vhost calls out to Let's Encrypt using the
|
||||
HTTP-01 challenge on `port` (default 80) and stores certs
|
||||
inside the gateway container's persistent state dir.
|
||||
Let the gateway's nginx obtain and renew TLS certificates
|
||||
automatically via ACME (Let's Encrypt). When enabled, each
|
||||
vhost calls out to Let's Encrypt using the HTTP-01
|
||||
challenge on `port` (default 80) and stores certs in the
|
||||
gateway's persistent state dir on the host.
|
||||
|
||||
Requirements:
|
||||
- `services.hyperhive.domain` must be set and publicly
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
# nginx virtual-host tree for the gateway container: the `_` default
|
||||
# server (dashboard, per-agent routing, matrix discovery), the forge
|
||||
# and matrix sub-domain vhosts, and the Accept-header SPA map for the
|
||||
# matrix GUI. Pure function — called from ./default.nix inside the
|
||||
# container config with the outer-scope config values as arguments;
|
||||
# returns `{ virtualHosts, appendHttpConfig }`.
|
||||
# nginx virtual-host tree for the gateway: the `_` default server
|
||||
# (dashboard, per-agent routing, matrix discovery), the forge, matrix
|
||||
# and authelia sub-domain vhosts, and the Accept-header SPA map for the
|
||||
# matrix GUI. Pure function — called from ./default.nix with the
|
||||
# outer-scope config values as arguments; returns
|
||||
# `{ virtualHosts, appendHttpConfig }`.
|
||||
{
|
||||
lib,
|
||||
cfg, # services.hyperhive.gateway
|
||||
|
|
|
|||
Loading…
Reference in a new issue