vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(harness): stop resolvconf/dhcpcd clobbering the bridge DNS resolver

Browse source 
Under network isolation, agents lost DNS resolution of the hive's own
zones (forge.<domain>, matrix.<domain>): the hyperhive-isolated-dns
oneshot points resolv.conf at the bridge resolver, but resolvconf
regenerated it from host-tracking right after (dhcpcd re-triggering that
when the veth comes up), reverting to the non-authoritative host
resolver. Agents then couldn't reach the in-hive forge or matrix through
the gateway, which broke an isolate-by-default rollout.

Take resolvconf and dhcpcd out of the resolv.conf loop: disable
resolvconf and tell dhcpcd not to touch resolv.conf (without disabling
dhcpcd itself, so the veth still gets its address). Then the last writer
owns it -- the nixos-container host-copy in shared netns, or the oneshot
in isolated mode. Mirrors the approach the matrix container already
takes. Eval-checked; flake check passes.
This commit is contained in:
atlas 2026-06-15 20:45:20 +02:00
commit 26d81cd36e
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/templates/harness-base.nix
View file

@ -1025,6 +1025,21 @@ in
# One-shot: tea config.yml from the seeded forge token. Shape # One-shot: tea config.yml from the seeded forge token. Shape
# contract (always exit 0, no set -e, skip-silently, re-runnable): # contract (always exit 0, no set -e, skip-silently, re-runnable):
# docs/conventions.md::Best-effort oneshot services. # docs/conventions.md::Best-effort oneshot services.
# Take resolvconf + dhcpcd out of the /etc/resolv.conf loop so the
# bridge resolver the oneshot below writes actually sticks. At their
# NixOS defaults, resolvconf regenerates resolv.conf from host-tracking
# *after* the oneshot has pointed it at the bridge (dhcpcd re-triggers
# that when the veth comes up under isolation) — silently clobbering the
# bridge nameserver back to the host resolver, which isn't authoritative
# for the hive's own zones, so `forge.<domain>` stops resolving. We
# disable resolvconf and tell dhcpcd not to touch resolv.conf (without
# disabling dhcpcd itself, so the veth still gets its address); then
# whoever wrote resolv.conf last owns it: the nixos-container host-copy
# in shared netns, or the oneshot in isolated mode. (Same "take
# resolvconf out of the loop" approach the matrix container uses.)
networking.resolvconf.enable = false;
networking.dhcpcd.extraConfig = "nohook resolv.conf";
# Point resolv.conf at the hive bridge resolver when the container is # Point resolv.conf at the hive bridge resolver when the container is
# network-isolated. nixos-container copies the *host's* /etc/resolv.conf # network-isolated. nixos-container copies the *host's* /etc/resolv.conf
# into the container at every start — but the host resolver (e.g. # into the container at every start — but the host resolver (e.g.