48067d07e8
Every hive's homeserver loaded a per-hive `hyperhive` appservice
registration, and the swarm minted and delivered an as_token for it
through bao. No client presented that token: swarm-controller creates
every `@hive-<hive>` sender and every agent account with the swarm
appservice token (hive_sender.rs, agent_token.rs), and no Rust code read
the per-hive one.
Removed, with everything that existed only to serve it:
- hive-matrix.nix: the `hyperhive` registration, its activation-time
render, the host bind mount of /var/lib/hyperhive/matrix-appservice,
its LoadCredential entry, and the internal options
`deploy.matrix.appserviceTokenFile` / `appserviceRegistrationScript`.
tuwunel now loads only the swarm registration.
- glue-matrix-bao-token.nix and its `swarm-bao-matrix-token` unit.
- glue-bao-tls.nix: the matrix-token leaf and its defaults.
- swarm-bao.nix: the `swarm-matrix-token-<hive>` roles and policies
(`swarm-bao-matrix-token-policy`), and the options
`deploy.bao.matrixTokenClient{Cert,Key}File` and
`matrixTokenCommonNamePrefix`, now mkRemovedOptionModule.
- swarm-secret-publisher.nix: the per-hive token mint and its state dir.
- swarm.nix: the reserved `<matrixTokenCommonNamePrefix>-<hive>` CN.
- swarm-secret-client: `matrix::appservice_token_path`.
The swarm registration (swarm-matrix-ctl, swarm-controller) is untouched.
Comments and docs that pointed at the removed glue file now point at
glue-queue-agent-credential.nix, which has the same reader shape.
Refs #4428
88 lines
3.4 KiB
Nix
88 lines
3.4 KiB
Nix
# `checks.module-eval-matrix-core` — see ./lib.nix for the shared
|
|
# rationale (why this suite exists, naming convention, "evaluates
|
|
# not executes").
|
|
{
|
|
pkgs,
|
|
lib,
|
|
self,
|
|
nixosSystem,
|
|
}:
|
|
let
|
|
inherit
|
|
(import ./lib.nix {
|
|
inherit
|
|
pkgs
|
|
lib
|
|
self
|
|
nixosSystem
|
|
;
|
|
})
|
|
hive
|
|
runGroup
|
|
;
|
|
|
|
# A deliberately odd `maxRequestSize`, so the number the assertion looks for
|
|
# cannot have come from a default or from another module's literal.
|
|
matrixBodyCap = hive {
|
|
deploy.singleHostSwarm = true;
|
|
deploy.matrix.maxRequestSize = 99000000;
|
|
};
|
|
|
|
# The same hive with the identity taken away, which separates "a homeserver
|
|
# is deployed" from "this host can authenticate to the store".
|
|
matrixNoBaoIdentity = hive { deploy.matrix.enable = true; };
|
|
|
|
# A hive host that does not run the homeserver: its hive-c0re reaches the
|
|
# homeserver across the network.
|
|
matrixElsewhere = hive { };
|
|
cases = [
|
|
{
|
|
# Absence arm, and what makes the one above able to fail: with no leaf
|
|
# this unit would fail a TLS handshake on every boot, so it must not
|
|
# exist at all rather than retry its way through the start limit.
|
|
name = "a hive with no store identity renders no queue credential reader";
|
|
ok = !(matrixNoBaoIdentity.systemd.services ? swarm-bao-queue-agent);
|
|
}
|
|
{
|
|
# Two limits governed a matrix upload and nothing kept them in agreement,
|
|
# so raising the documented one past the gateway's hardcoded cap changed
|
|
# nothing. The second clause is the control: the old directive is gone, so
|
|
# a pass means the value is derived rather than that `hasInfix` matched
|
|
# something incidental. It targets the whole directive rather than the
|
|
# bare size, because the rendered config carries the comment above it and
|
|
# a prose mention of the old value would defeat a looser arm.
|
|
name = "the matrix gateway's body cap is derived from maxRequestSize, not a literal";
|
|
ok =
|
|
let
|
|
c = matrixBodyCap.services.nginx.virtualHosts."chat.t.local".locations."/_matrix/".extraConfig;
|
|
in
|
|
lib.hasInfix "client_max_body_size 100048576;" c && !(lib.hasInfix "client_max_body_size 50M" c);
|
|
}
|
|
{
|
|
# Absence arm. A hive with no client identity gets no
|
|
# store environment at all — the daemon reports a queue it cannot serve
|
|
# rather than a handshake it cannot explain.
|
|
name = "a hive with no client identity gives hive-c0re no store environment";
|
|
ok =
|
|
let
|
|
s = matrixNoBaoIdentity.systemd.services;
|
|
in
|
|
s ? hive-c0re
|
|
&& !(s.hive-c0re.environment ? BAO_ADDR)
|
|
&& !(lib.any (c: lib.hasPrefix "bao-" c) s.hive-c0re.serviceConfig.LoadCredential);
|
|
}
|
|
{
|
|
# hive-c0re logs in with the hive's matrix token over this URL, and on a
|
|
# host without the homeserver that login crosses the network, so the
|
|
# default must be TLS all the way to the daemon's environment.
|
|
name = "hive-c0re provisions matrix over https from a hive that does not run it";
|
|
ok =
|
|
!matrixElsewhere.services.hyperhive.deploy.matrix.enable
|
|
&& matrixElsewhere.services.hyperhive.swarm.matrix.apiUrl == "https://chat.t.local"
|
|
&&
|
|
matrixElsewhere.systemd.services.hive-c0re.environment.HIVE_MATRIX_API_URL
|
|
== "https://chat.t.local";
|
|
}
|
|
];
|
|
in
|
|
runGroup "matrix-core" cases
|