vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: shared-netns infra containers must not run their own firewall

Browse source
This commit is contained in:
müde 2026-07-14 00:08:33 +02:00
commit 0d416df1e8
4 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/network.md
View file

@ -145,6 +145,17 @@ agent containers.
container, shared host netns) for the forge sub-domain, per-agent
UI proxies, and any other HTTP services.
The **host** firewall is the only firewall. The shared-netns infra
containers (gateway, forge, matrix) set
`networking.firewall.enable = false`: a NixOS firewall inside a
shared-netns container runs against the *host* ruleset — at container
boot its `firewall-start` flushes the `nixos-fw` chains, rebuilds them
from the container's (empty) port list, and deletes the host's
`nixos-nat-*` chains without recreating them, silently wiping the
bridge holes above plus the agents' NAT. Private-netns containers
(agents, hive-ci) may keep their own firewall — it is scoped to their
namespace.
### Reaching host services (`exposeHostPorts`)
By default agents can only reach the host on 80/443 (+53 DNS), so a

8
nix/host-modules/hive-forge/default.nix
View file

@ -327,6 +327,14 @@ in
in
{
system.stateVersion = "25.11";
# Shared host netns: this container's own firewall.service
# would rewrite the HOST ruleset (flush nixos-fw, drop the
# host's nixos-nat-* chains) at every boot — killing the
# bridge DHCP/DNS holes and agent NAT. The host firewall owns
# all filtering; never run one in here.
networking.firewall.enable = false;
services.forgejo = {
enable = true;
package = cfg.package;

9
nix/host-modules/hive-gateway/default.nix
View file

@ -163,6 +163,15 @@ in
{
system.stateVersion = "26.05";
# This container shares the host netns, so its own
# firewall.service would run against the HOST ruleset: flush
# the nixos-fw chains, rebuild them from this container's
# (empty) port list, and delete the host's nixos-nat-* chains
# — wiping the bridge DHCP/DNS holes and the agents' NAT on
# every container boot. The host firewall owns all filtering;
# never run one in here.
networking.firewall.enable = false;
# Keep the host-copied /etc/resolv.conf intact. nixos-container
# copies the host's file in at every container start, but
# resolvconf's host-tracking mode then regenerates it — to an

7
nix/host-modules/hive-matrix.nix
View file

@ -341,6 +341,13 @@ in
{
system.stateVersion = "26.05";
# Shared host netns: this container's own firewall.service
# would rewrite the HOST ruleset (flush nixos-fw, drop the
# host's nixos-nat-* chains) at every boot — killing the
# bridge DHCP/DNS holes and agent NAT. The host firewall owns
# all filtering; never run one in here.
networking.firewall.enable = false;
# Peer-hive root CAs (`swarm.peers.<domain>.caCert`) added to THIS
# container's trust bundle so tuwunel validates *federation* TLS
# from a self-signed peer hive (it checks the peer's federation