mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress: reject needs the intercept

Browse source
This commit is contained in:
atlas 2026-11-13 12:27:53 +01:00
commit 70a8e54038
1 changed files with 40 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/hive-egress.nix
View file

@ -473,6 +473,17 @@ in
the low 17 bits of the agent's address.
'';
}
{
assertion = cfg.egress.forward != "reject" || cfg.egress.intercept.enable;
message = ''
services.hyperhive.network.egress.forward = "reject" needs
services.hyperhive.network.egress.intercept.enable = true:
without the intercept nothing redirects the agents' web traffic into
squid, and the reject would refuse all of it.
Enable the intercept (hive-squid.nix does on a hive controller host),
or keep forward = "log".
'';
}
{
assertion = !(lib.any (k: isOn (config.boot.kernel.sysctl.${k} or 0)) routeLocalnetKeys);
message = ''