mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run swarm-attic in its own network namespace

Browse source 
the gateway reaches atticd over a unix socket a relay in the container
forwards, and the host unit that creates the cache dials its public name.
This commit is contained in:
atlas 2026-11-02 23:56:41 +01:00 • committed by mara
commit 1d3ab2fae5
2 changed files with 198 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/module-eval/builder.nix
View file

@ -462,7 +462,7 @@ let
&& lib.elem "swarm-bao-attic-policy.service" atticSecret.after
&& lib.elem "swarm-bao-attic-policy.service" atticTokens.after
&& atticHere.containers.swarm-attic.bindMounts."/run/swarm-attic-secrets".isReadOnly
&& !atticHere.containers.swarm-attic.privateNetwork
&& atticHere.containers.swarm-attic.privateNetwork
&& atticUnit.serviceConfig.EnvironmentFile == "/run/swarm-attic-secrets/server.env"
&& lib.hasInfix "--mode monolithic" atticUnit.serviceConfig.ExecStart
&& atticDeploy.retentionPeriod == "14 days";
@ -534,7 +534,7 @@ let
names = m: m.services.hyperhive.swarm.serviceDomains;
in
atticVhost.forceSSL
&& atticVhost.locations."/".proxyPass == "http://127.0.0.1:8910"
&& atticVhost.locations."/".proxyPass == "http://unix:/run/swarm-attic/atticd.sock"
&& !(lib.hasInfix "auth_request" atticVhost.locations."/".extraConfig)
&& lib.hasInfix "client_max_body_size 0" atticVhost.locations."/".extraConfig
&& lib.hasInfix "proxy_request_buffering off" atticVhost.locations."/".extraConfig

50
nix/module-eval/swarm-services-switch.nix
View file

@ -174,8 +174,8 @@ let
# Every service container at once: the services-only host plus the CI
# runner. The CI runner, the review classifier, the notification router, the
# builder, the claude login minter, the metrics store, the homeserver,
# authelia, Grafana and the collector are the ten containers on a netns of
# their own.
# authelia, Grafana, the collector and the cache are the eleven containers on
# a netns of their own.
serviceContainersWithCi = hive {
deploy.hive-controller.enable = false;
deploy.allSwarmServices = true;
@ -814,14 +814,14 @@ let
}
{
# Both values come from ../container-modules/swarm-container.nix.
# Five of the 15 service containers share the host netns (hive-forge, bao,
# the queue, the log store, the cache) and ten have one of their own.
# Four of the 15 service containers share the host netns (hive-forge, bao,
# the queue, the log store) and eleven have one of their own.
name = "a service container on the host netns runs no firewall or resolvconf of its own";
ok =
let
shared = lib.filter (c: !c.privateNetwork) (lib.attrValues serviceContainers);
in
lib.length shared == 5
lib.length shared == 4
&& lib.all (
c: !c.config.networking.firewall.enable && !c.config.networking.resolvconf.enable
) shared;
@ -992,6 +992,46 @@ let
&& lib.all (lib.hasPrefix "http://unix:${sock}:") forwarded
&& c.bindMounts.${dir}.hostPath == dir;
}
{
# atticd listens on the container's own loopback, a relay there forwards
# the socket nginx connects to, and the host unit that drives the
# TCP-only `attic` client dials the published name, not a loopback. The
# `cache create` clause and the trust-bundle clauses are controls: they
# find something in the same script and unit the absences are claimed of.
# `upstreams != []` keeps an empty vhost from passing.
name = "the cache runs on a netns of its own, the gateway reaches it over a socket and the host unit dials its public name";
ok =
let
host = serviceContainersWithCi;
h = host.services.hyperhive;
c = host.containers.swarm-attic;
dir = "/run/swarm-attic";
sock = "${dir}/atticd.sock";
domain = h.swarm.attic.domain;
upstreams = map (l: l.proxyPass) (lib.attrValues h.gateway.vhosts.${domain}.locations);
relay = c.config.systemd.services.swarm-attic-relay;
tokens = host.systemd.services.swarm-bao-attic-tokens;
in
c.privateNetwork
&& c.hostBridge == h.network.bridgeName
&& c.hostAddress == null
&& c.localAddress == null
&& c.config.networking.interfaces.eth0.useDHCP
&& c.config.networking.firewall.enable
&& upstreams != [ ]
&& lib.all (p: p == "http://unix:${sock}") upstreams
&& c.config.systemd.sockets.swarm-attic-relay.listenStreams == [ sock ]
&& lib.hasSuffix "systemd-socket-proxyd 127.0.0.1:${toString h.deploy.attic.port}" relay.serviceConfig.ExecStart
&& c.bindMounts.${dir}.hostPath == dir
&& lib.elem "d ${dir} 0770 root ${toString host.ids.gids.nginx} - -" host.systemd.tmpfiles.rules
&& lib.hasInfix "cache create" tokens.script
&& lib.hasInfix "https://${domain}" tokens.script
&& !(lib.hasInfix "127.0.0.1" tokens.script)
&& lib.elem "nginx.service" tokens.after
&& h.gateway.useSelfSigned
&& tokens.environment.SSL_CERT_FILE == "/run/swarm-bao-attic-tokens-ca/trust-bundle.pem"
&& lib.elem "swarm-bao-attic-tokens-ca-bundle.service" tokens.requires;
}
{
# On the bridge by DHCP, with every receiver on a socket: the hive's, the
# swarm tier's and each service forwarder's. Every gateway location that