467cb347ad
A swarm has one message queue; this is the container that runs it, in the same shape as every other swarm service. Off by default, and off means absent. The auth_callout block is the interim state and the final one at once. Measured on the pinned nats-server rather than reasoned about: an empty authorization block, and one with an empty users list, both accept an anonymous client and answer PONG. auth_callout sets auth_required and refuses everyone until a responder approves them, so a config whose responder does not exist yet denies by default -- and the responder lands beside it without any of this being swapped out. That matters more here than it would elsewhere because the container shares the host netns, so an unauthenticated interim state would be reachable from every agent container on the hive. No package option, deliberately: nixpkgs' nats module resolves pkgs.nats-server itself and exposes none, so one here would name something it cannot control. No gateway vhost either: NATS speaks its own TCP protocol, nginx cannot front it, and cross-hive reach is the wireguard mesh.
36 lines
1.1 KiB
Nix
36 lines
1.1 KiB
Nix
# The full hyperhive host stack, pulled together in one place — this
|
|
# is what the flake exports as `nixosModules.default` (wrapped with
|
|
# the package/source wiring; see flake.nix). One import covers
|
|
# everything; `services.hyperhive.enable = true` turns the stack on.
|
|
#
|
|
# The forge is mandatory — hive-c0re mirrors every agent's applied
|
|
# config repo into it and it's the canonical store for the meta flake
|
|
# + `internal/*` repos, so there's no enable toggle; it deploys with
|
|
# hyperhive itself. hive-matrix is opt-in (off by default). All
|
|
# subsystems rely on `services.hyperhive.domain`, which is required
|
|
# (asserted in hive-network.nix) whenever hyperhive is enabled.
|
|
{
|
|
imports = [
|
|
./hyperhive.nix
|
|
./local-defaults.nix
|
|
./hive-c0re
|
|
./hive-ci.nix
|
|
./hive-forge
|
|
./hive-gateway
|
|
./hive-matrix.nix
|
|
./hive-network.nix
|
|
./hive-priv.nix
|
|
./hive-tls.nix
|
|
./otel.nix
|
|
./swarm-authelia.nix
|
|
./swarm-ca.nix
|
|
./swarm-nats.nix
|
|
./swarm-controller.nix
|
|
./swarm-snapshot-store.nix
|
|
./swarm-ui.nix
|
|
./swarm-wireguard.nix
|
|
./swarm.nix
|
|
./swarm-peers-removed.nix
|
|
./swarm-required-services.nix
|
|
];
|
|
}
|