mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agent bridge: drop frames whose source MAC or address isn't the container's own (egress.antiSpoof)

Browse source
This commit is contained in:
atlas 2026-11-13 02:36:38 +01:00 • committed by mara
commit c4ac01ef88
1 changed files with 636 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/vm-tests/hive-squid.nix
View file

@ -197,6 +197,11 @@ pkgs.testers.runNixOSTest {
);
# The gateway: nginx answers on the bridge, which agents reach directly.
networking.firewall.interfaces.eth1.allowedTCPPorts = [ 443 ];
# hive-priv.nix links the binary the hive-egress unit runs to bind bridge
# ports; `eth1` is no bridge here, so a stub that binds nothing stands in.
systemd.tmpfiles.rules = [
"L+ /run/hive-rootfs-check - - - - ${pkgs.writeShellScript "hive-priv-stub" "exit 0"}"
];
# Renders the users file the way hive-c0re does.
environment.systemPackages = [
pkgs.mkpasswd