From 25d5b4b69c5f1d3e6e825726bab7c09a8b494bb5 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 12 Aug 2026 16:41:59 +0200 Subject: [PATCH] fix(3149): the forge container can resolve the authelia name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The login source still failed after the argv fix, with dial tcp: lookup auth.constellation.darkest.space: no such host The hive's dnsmasq is authoritative for the swarm service names, but only containers whose resolv.conf points at the bridge ask it — agent containers do, via an explicit unit written for that reason (nix/agent-modules/network.nix). hive-forge resolves through the host's resolvers instead, and the swarm domain has no public records, so discovery fails for a name that resolves fine one container over. Publish it in the container's own hosts file, mapped to 127.0.0.1: sharing the host netns, loopback is the host, where nginx already serves that vhost. TLS still validates - the CA trust bundle is bind-mounted and the leaf covers the name. Gated on authelia being local, since a remote provider's name belongs to another machine. Gate (state/eval-3149-hosts.sh) asserts the RENDERED /etc/hosts rather than the option, plus an absence probe with SSO off and a check that the discovery URL names the same host the entry publishes. --- nix/host-modules/hive-forge/default.nix | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index 0967fafe..2cc01ce6 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -535,6 +535,28 @@ in # all filtering; never run one in here. networking.firewall.enable = false; + # Teach this container the SSO name, because nothing else will. + # + # The hive's dnsmasq is authoritative for the swarm service + # names, but only containers whose resolv.conf points at the + # bridge ask it — agent containers do, by an explicit unit + # (`nix/agent-modules/network.nix`) written for exactly this + # reason. This container resolves through the host's resolvers + # instead, and the swarm domain has no public records, so + # `admin auth add-oauth` fails at discovery with "no such + # host" while the same name resolves fine one container over. + # + # `127.0.0.1` rather than the bridge IP: sharing the host netns + # means loopback IS the host, where nginx serves this vhost. + # TLS still validates — the CA trust bundle is bind-mounted + # above, and the leaf covers this name. + # + # Only when THIS host runs authelia. With a remote provider the + # name belongs to another machine and must resolve normally. + networking.hosts = lib.mkIf ssoLocal { + "127.0.0.1" = [ autheliaCfg.domain ]; + }; + services.forgejo = { enable = true; package = cfg.package;