vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: shared-netns infra containers must not run their own firewall

Browse source
This commit is contained in:
müde 2026-07-14 00:08:33 +02:00
commit 0d416df1e8
4 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/host-modules/hive-gateway/default.nix
View file

@ -163,6 +163,15 @@ in
{
system.stateVersion = "26.05";
# This container shares the host netns, so its own
# firewall.service would run against the HOST ruleset: flush
# the nixos-fw chains, rebuild them from this container's
# (empty) port list, and delete the host's nixos-nat-* chains
# — wiping the bridge DHCP/DNS holes and the agents' NAT on
# every container boot. The host firewall owns all filtering;
# never run one in here.
networking.firewall.enable = false;
# Keep the host-copied /etc/resolv.conf intact. nixos-container
# copies the host's file in at every container start, but
# resolvconf's host-tracking mode then regenerates it — to an