92559af8e7
The dashboard, its API, the swagger UI and the agent routes move to their own vhost, `swarm.dashboardDomain` = `<hive>.hives.<swarm.domain>`, under the swarm domain so authelia's session cookie reaches it. `/`, `/api/` and `/api/docs/` ask authelia through `auth_request`, and authelia's `operatorsOnly` rule for each hive's dashboard name lets only the admins group in. The hive domain keeps matrix discovery and redirects every other path to the new name. The name rides as a SAN on the hive's own gateway leaf: the per-hive bao role allows it, and hive-tls asks for it and checks coverage. HTTP Basic auth is gone: the htpasswd writer and its test, the `hivectl gateway` verbs and host-socket requests, the `gateway.auth` options (now a removed-option error), the unauthorized page and the bcrypt dependency. tmpfiles deletes a leftover gateway.htpasswd, which held bcrypt hashes at 0644. c0re hands out dashboard and agent URLs on the new name (HYPERHIVE_DASHBOARD_DOMAIN), and the swarm controller's hive roster carries each hive's dashboard name for the swarm UI's hive list. Closes #3469
70 lines
2.7 KiB
Nix
70 lines
2.7 KiB
Nix
# Static error/help pages the gateway serves for routes it has
|
|
# special-cased, all rendered from one Catppuccin-styled template.
|
|
# Useful pages instead of nginx's default 404/502 — see
|
|
# `docs/networking/gateway.md::Per-agent error pages` for the design rationale +
|
|
# page-vs-status semantics. Consumed by ./vhosts.nix.
|
|
{ pkgs }:
|
|
let
|
|
mkPage =
|
|
{
|
|
name,
|
|
title,
|
|
accent,
|
|
body,
|
|
}:
|
|
pkgs.writeText "hive-gateway-${name}.html" ''
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>${title} ◆ hyperhive</title>
|
|
<style>
|
|
body { background: #1e1e2e; color: #cdd6f4; font: 14px/1.5 -apple-system, system-ui, sans-serif; margin: 0; padding: 4rem 1rem; text-align: center; }
|
|
h1 { color: ${accent}; font-size: 1.5rem; margin: 0 0 0.5rem; }
|
|
p { max-width: 36rem; margin: 0.5rem auto; color: #a6adc8; }
|
|
code { background: #313244; color: #f5c2e7; padding: 0.1rem 0.35rem; border-radius: 0.2rem; font-size: 0.92em; }
|
|
pre { background: #181825; color: #cdd6f4; text-align: left; display: inline-block; padding: 0.75rem 1.25rem; border-radius: 0.4rem; margin: 0.75rem 0; font-size: 0.88em; line-height: 1.6; }
|
|
a { color: #89b4fa; }
|
|
.hint { color: #a6adc8; font-size: 0.9em; margin-top: 1.5rem; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<h1>◆ ${title}</h1>
|
|
${body}
|
|
</body>
|
|
</html>
|
|
'';
|
|
in
|
|
{
|
|
notFound = mkPage {
|
|
name = "agent-not-found";
|
|
title = "agent not found";
|
|
accent = "#cba6f7";
|
|
body = ''
|
|
<p>No agent matches the requested <code>/agent/<name>/</code> path on this hive.</p>
|
|
<p>Operator: check the agent name in <a href="/">the dashboard</a>.</p>
|
|
'';
|
|
};
|
|
|
|
unreachable = mkPage {
|
|
name = "agent-unreachable";
|
|
title = "agent unreachable";
|
|
accent = "#f9e2af";
|
|
body = ''
|
|
<p>The agent's harness web server isn't responding. Container restarting, or the agent crashed.</p>
|
|
<p>Operator: <a href="/">dashboard</a> → check the container status / journal; the page will recover on retry once the harness is back up.</p>
|
|
'';
|
|
};
|
|
|
|
# Shown when the authelia vhost's upstream refuses the connection: authelia
|
|
# is down behind a working gateway, and the raw 502 points at the proxy.
|
|
ssoUnavailable = mkPage {
|
|
name = "sso-unavailable";
|
|
title = "sso unavailable";
|
|
accent = "#f9e2af";
|
|
body = ''
|
|
<p>The swarm's identity provider isn't answering. The gateway is fine — nothing is listening behind it.</p>
|
|
<p class="hint">Check the container: <code>journalctl -M swarm-authelia -u authelia-swarm</code>. This page recovers on reload once the provider is up.</p>
|
|
'';
|
|
};
|
|
}
|