vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(nix): fix remaining stale shared-netns references in harness-base.nix

Browse source 
- Option doc: 'Default points at the in-host tuwunel (shared netns)'
  → updated to reflect that c0re forwards the gateway URL at runtime
- DNS oneshot comment: 'inert in shared-netns mode' → removed since
  isolation is always on; oneshot always runs
This commit is contained in:
atlas 2026-07-04 21:08:09 +02:00 • committed by mara
commit 03e07c7d37
1 changed files with 12 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

23
nix/templates/harness-base.nix
View file

@ -510,10 +510,12 @@ in
example = "https://matrix.darkest.space";
description = ''
Matrix homeserver URL the agent's `hive-matrix-daemon` connects
to. Default points at the in-host tuwunel (shared netns).
Override per-agent when an agent should talk to an external
homeserver instead (e.g. a federation-only setup or a remote
hive's tuwunel reached via a vpn).
to. At runtime hive-c0re forwards the isolation-aware URL
(`matrix.<domain>` via the gateway) so isolated agents reach
the homeserver without crossing host loopback. Override
per-agent when an agent should talk to an external homeserver
instead (e.g. a federation-only setup or a remote hive's
tuwunel reached via a vpn).
'';
};
@ -1516,8 +1518,7 @@ in
# for the hive's own zones, so `forge.<domain>` stops resolving. We
# disable resolvconf and tell dhcpcd not to touch resolv.conf (without
# disabling dhcpcd itself, so the veth still gets its address); then
# whoever wrote resolv.conf last owns it: the nixos-container host-copy
# in shared netns, or the oneshot in isolated mode. (Same "take
# the hyperhive-isolated-dns oneshot owns resolv.conf. (Same "take
# resolvconf out of the loop" approach the matrix container uses.)
networking.resolvconf.enable = false;
networking.dhcpcd.extraConfig = "nohook resolv.conf";
@ -1528,11 +1529,11 @@ in
# 127.0.0.53) is unreachable from a private netns and isn't
# authoritative for the hive's own zones (forge.<domain> etc.). The
# bridge dnsmasq (gateway IP) is. hive-priv drops the marker
# `/etc/hyperhive-bridge-dns` (containing the gateway IP) only when
# isolation is on, so this oneshot is inert in shared-netns mode — the
# same shared container toplevel does the right thing in both modes.
# Ordered before the first DNS consumer (tea-login) and the network
# targets so name resolution works for the very first turn.
# `/etc/hyperhive-bridge-dns` (containing the gateway IP) since
# isolation is always on; the oneshot reads it and rewrites
# resolv.conf on every boot. Ordered before the first DNS consumer
# (tea-login) and the network targets so name resolution works for
# the very first turn.
systemd.services.hyperhive-isolated-dns = {
description = "point resolv.conf at the hive bridge resolver (isolated containers)";
wantedBy = [ "multi-user.target" ];