From 7feef4cc5d7f22c9769604d2f6d574182168f840 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 30 May 2026 19:25:28 +0200 Subject: [PATCH 1/2] nix: openFirewall defaults false across forge/gateway/matrix (#651) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mara on #651: "Dont default openFirewall to true." Flip the `openFirewall` default from `true` to `false` for all three modules that expose host-side ports: - `services.hyperhive.forge.openFirewall` (httpPort 3000 + sshPort 2222) - `services.hyperhive.gateway.openFirewall` (port 80) - `services.hyperhive.matrix.openFirewall` (httpPort 8008) Rationale: secure-by-default. With shared host netns, the host + every agent container reach these services via `localhost` regardless of the firewall — the open only matters for access from outside the host. Operators who want external reach now flip the bool explicitly: services.hyperhive.gateway.openFirewall = true; Each description updated to explain the new default + when to flip it (operator's browser, external git clients, federation announcement, etc.). Behind a host-level reverse proxy that handles TLS, leave off. Verified via `nix eval` on a clean stub config: - forge openFirewall = false - gateway openFirewall = false - matrix openFirewall = false - networking.firewall.allowedTCPPorts = [] (was: [80 2222 3000 8008]) Note: c0re's direct ports (7000/8000/8100-8999) are gated separately via #621 on `gateway.enable` — that gate stays; this PR only touches the per-module `openFirewall` knobs. Closes #651. --- nix/modules/hive-forge.nix | 15 ++++++++++----- nix/modules/hive-gateway.nix | 14 ++++++++++---- nix/modules/hive-matrix.nix | 14 +++++++++----- 3 files changed, 29 insertions(+), 14 deletions(-) diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix index 73639373..8abb20f4 100644 --- a/nix/modules/hive-forge.nix +++ b/nix/modules/hive-forge.nix @@ -87,12 +87,17 @@ in openFirewall = lib.mkOption { type = lib.types.bool; - default = true; + default = false; + example = true; description = '' - Open `httpPort` + `sshPort` in the host firewall. Off when - the forge should only be reachable from inside the host. - (The container shares host netns, so this is the only - firewall layer that matters.) + Open `httpPort` + `sshPort` in the host firewall. Off by + default (#651, secure-by-default): the forge is reachable + from the host + every agent container via `localhost` either + way (shared netns), so the firewall opens only matter for + access from outside the host. Flip to `true` when you want + the operator's browser / external git clients to hit the + forge directly. (The container shares host netns, so this + is the only firewall layer that matters.) ''; }; }; diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index c4c288c2..a81e088d 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -82,11 +82,17 @@ in openFirewall = lib.mkOption { type = lib.types.bool; - default = true; + default = false; + example = true; description = '' - Open `port` in the host firewall. Off when the gateway should - only be reachable from inside the host (e.g. behind another - reverse proxy that handles TLS termination). + Open `port` in the host firewall. Off by default (#651, + secure-by-default). Flip to `true` to expose the gateway to + the operator's browser / external clients — required for any + out-of-host reach, since the agents themselves talk to + hive-c0re via the per-agent unix sockets and don't need the + nginx vhost. Leave off when running behind another reverse + proxy (e.g. caddy / traefik on the host) that handles TLS + termination + forwards to `port`. ''; }; diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix index 750c1ea8..4ad016de 100644 --- a/nix/modules/hive-matrix.nix +++ b/nix/modules/hive-matrix.nix @@ -98,12 +98,16 @@ in openFirewall = lib.mkOption { type = lib.types.bool; - default = true; + default = false; + example = true; description = '' - Open `httpPort` in the host firewall. Off when the - homeserver should only be reachable from inside the host - (e.g. while bringing the integration up before announcing - it to other hives). + Open `httpPort` in the host firewall. Off by default (#651, + secure-by-default): the homeserver is reachable from the + host + every agent container via `localhost` either way + (shared netns), so the firewall open only matters for + access from outside the host. Flip to `true` when announcing + the homeserver to other hives or when an external matrix + client needs to reach the client-server API directly. Note: federation (the matrix-spec well-known port 8448) is intentionally not opened here. tuwunel serves the federation From 85790b0ccabb55f9ebb7e8da51058da386c78f61 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 30 May 2026 19:30:11 +0200 Subject: [PATCH 2/2] nix: add breaking-change note to each openFirewall description (argus #653) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit argus picked option (a) on #653: put the upgrade note in each option's `description` so it shows up in `nix flake show` + the rendered options docs, right next to the option itself. cheapest option, no eval-time noise (a `warnings` block would fire on every new deployment that wants false — the normal case now). Appended a `**Breaking change as of #651**` paragraph to each of the three `openFirewall` descriptions, naming the exact option string the operator needs to set to restore the old behaviour. Gateway's note specifically calls out that external reach is the common case (operator's primary entry point), so the upgrade hint is most likely needed there. --- nix/modules/hive-forge.nix | 5 +++++ nix/modules/hive-gateway.nix | 6 ++++++ nix/modules/hive-matrix.nix | 5 +++++ 3 files changed, 16 insertions(+) diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix index 8abb20f4..64ad4ee4 100644 --- a/nix/modules/hive-forge.nix +++ b/nix/modules/hive-forge.nix @@ -98,6 +98,11 @@ in the operator's browser / external git clients to hit the forge directly. (The container shares host netns, so this is the only firewall layer that matters.) + + **Breaking change as of #651**: this used to default to + `true`. If you relied on the old default for external + reach, add `services.hyperhive.forge.openFirewall = true;` + to your host config before rebuilding. ''; }; }; diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix index a81e088d..f051fe0d 100644 --- a/nix/modules/hive-gateway.nix +++ b/nix/modules/hive-gateway.nix @@ -93,6 +93,12 @@ in nginx vhost. Leave off when running behind another reverse proxy (e.g. caddy / traefik on the host) that handles TLS termination + forwards to `port`. + + **Breaking change as of #651**: this used to default to + `true`. If you relied on the old default for external reach + (the common case — the gateway is the operator's primary + entry point), add `services.hyperhive.gateway.openFirewall = true;` + to your host config before rebuilding. ''; }; diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix index 4ad016de..5be59b66 100644 --- a/nix/modules/hive-matrix.nix +++ b/nix/modules/hive-matrix.nix @@ -109,6 +109,11 @@ in the homeserver to other hives or when an external matrix client needs to reach the client-server API directly. + **Breaking change as of #651**: this used to default to + `true`. If you relied on the old default for external reach, + add `services.hyperhive.matrix.openFirewall = true;` to + your host config before rebuilding. + Note: federation (the matrix-spec well-known port 8448) is intentionally not opened here. tuwunel serves the federation API on the same `httpPort` as the client-server API by