vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(3149): the forge container can resolve the authelia name

Browse source 
The login source still failed after the argv fix, with

  dial tcp: lookup auth.constellation.darkest.space: no such host

The hive's dnsmasq is authoritative for the swarm service names, but
only containers whose resolv.conf points at the bridge ask it — agent
containers do, via an explicit unit written for that reason
(nix/agent-modules/network.nix). hive-forge resolves through the host's
resolvers instead, and the swarm domain has no public records, so
discovery fails for a name that resolves fine one container over.

Publish it in the container's own hosts file, mapped to 127.0.0.1:
sharing the host netns, loopback is the host, where nginx already serves
that vhost. TLS still validates - the CA trust bundle is bind-mounted
and the leaf covers the name. Gated on authelia being local, since a
remote provider's name belongs to another machine.

Gate (state/eval-3149-hosts.sh) asserts the RENDERED /etc/hosts rather
than the option, plus an absence probe with SSO off and a check that the
discovery URL names the same host the entry publishes.
This commit is contained in:
atlas 2026-08-12 16:41:59 +02:00 • committed by mara
commit 25d5b4b69c
1 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nix/host-modules/hive-forge/default.nix
View file

@ -535,6 +535,28 @@ in
# all filtering; never run one in here.
networking.firewall.enable = false;
# Teach this container the SSO name, because nothing else will.
#
# The hive's dnsmasq is authoritative for the swarm service
# names, but only containers whose resolv.conf points at the
# bridge ask it — agent containers do, by an explicit unit
# (`nix/agent-modules/network.nix`) written for exactly this
# reason. This container resolves through the host's resolvers
# instead, and the swarm domain has no public records, so
# `admin auth add-oauth` fails at discovery with "no such
# host" while the same name resolves fine one container over.
#
# `127.0.0.1` rather than the bridge IP: sharing the host netns
# means loopback IS the host, where nginx serves this vhost.
# TLS still validates — the CA trust bundle is bind-mounted
# above, and the leaf covers this name.
#
# Only when THIS host runs authelia. With a remote provider the
# name belongs to another machine and must resolve normally.
networking.hosts = lib.mkIf ssoLocal {
"127.0.0.1" = [ autheliaCfg.domain ];
};
services.forgejo = {
enable = true;
package = cfg.package;