vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: shared-netns infra containers must not run their own firewall

Browse source
This commit is contained in:
müde 2026-07-14 00:08:33 +02:00
commit 0d416df1e8
4 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/host-modules/hive-forge/default.nix
View file

@ -327,6 +327,14 @@ in
in
{
system.stateVersion = "25.11";
# Shared host netns: this container's own firewall.service
# would rewrite the HOST ruleset (flush nixos-fw, drop the
# host's nixos-nat-* chains) at every boot — killing the
# bridge DHCP/DNS holes and agent NAT. The host firewall owns
# all filtering; never run one in here.
networking.firewall.enable = false;
services.forgejo = {
enable = true;
package = cfg.package;

9
nix/host-modules/hive-gateway/default.nix
View file

@ -163,6 +163,15 @@ in
{
system.stateVersion = "26.05";
# This container shares the host netns, so its own
# firewall.service would run against the HOST ruleset: flush
# the nixos-fw chains, rebuild them from this container's
# (empty) port list, and delete the host's nixos-nat-* chains
# — wiping the bridge DHCP/DNS holes and the agents' NAT on
# every container boot. The host firewall owns all filtering;
# never run one in here.
networking.firewall.enable = false;
# Keep the host-copied /etc/resolv.conf intact. nixos-container
# copies the host's file in at every container start, but
# resolvconf's host-tracking mode then regenerates it — to an

7
nix/host-modules/hive-matrix.nix
View file

@ -341,6 +341,13 @@ in
{
system.stateVersion = "26.05";
# Shared host netns: this container's own firewall.service
# would rewrite the HOST ruleset (flush nixos-fw, drop the
# host's nixos-nat-* chains) at every boot — killing the
# bridge DHCP/DNS holes and agent NAT. The host firewall owns
# all filtering; never run one in here.
networking.firewall.enable = false;
# Peer-hive root CAs (`swarm.peers.<domain>.caCert`) added to THIS
# container's trust bundle so tuwunel validates *federation* TLS
# from a self-signed peer hive (it checks the peer's federation