nix/hive-c0re: pin HIVE_FORGE_URL to 127.0.0.1 — agents can't resolve forge.<hive-domain> (#761)

This commit is contained in:
damocles 2026-05-31 13:51:03 +02:00
commit 0af6ea1dd0

View file

@ -307,9 +307,21 @@ in
HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarmName; HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarmName;
} }
// lib.optionalAttrs config.services.hyperhive.forge.enable { // lib.optionalAttrs config.services.hyperhive.forge.enable {
# Agents poll this URL for Forgejo notifications. Derived from # Agents poll this URL for Forgejo notifications + run all
# services.hyperhive.forge.{domain,httpPort} so it tracks forge config changes. # `hive-forge` calls against it. Pinned to `127.0.0.1` for
HIVE_FORGE_URL = "http://${config.services.hyperhive.forge.domain}:${toString config.services.hyperhive.forge.httpPort}"; # the in-cluster path: every agent container shares the
# host's network namespace so loopback reaches the forge
# container directly, no DNS lookup needed (closes #761).
#
# Post-#754 `cfg.domain` defaults to `forge.<hive-domain>`
# for the external gateway vhost. Using that value here
# would route every in-cluster call through DNS for an
# external hostname agents can't resolve from inside their
# nspawn — every `hive-forge` invocation would fail with
# "Name or service not known". The external gateway URL
# is for operator browsers + cross-host clients; internal
# callers stay on loopback.
HIVE_FORGE_URL = "http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}";
} }
// lib.optionalAttrs config.services.hyperhive.matrix.gui.enable { // lib.optionalAttrs config.services.hyperhive.matrix.gui.enable {
# Availability flag for `/api/state.matrix_gui_enabled`. The # Availability flag for `/api/state.matrix_gui_enabled`. The