vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: shared-netns infra containers must not run their own firewall

Browse source
This commit is contained in:
müde 2026-07-14 00:08:33 +02:00
commit 0d416df1e8
4 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nix/host-modules/hive-matrix.nix
View file

@ -341,6 +341,13 @@ in
{
system.stateVersion = "26.05";
# Shared host netns: this container's own firewall.service
# would rewrite the HOST ruleset (flush nixos-fw, drop the
# host's nixos-nat-* chains) at every boot — killing the
# bridge DHCP/DNS holes and agent NAT. The host firewall owns
# all filtering; never run one in here.
networking.firewall.enable = false;
# Peer-hive root CAs (`swarm.peers.<domain>.caCert`) added to THIS
# container's trust bundle so tuwunel validates *federation* TLS
# from a self-signed peer hive (it checks the peer's federation