From 38f2435767719427170467a4b5a1d7a5c286e6c7 Mon Sep 17 00:00:00 2001
From: atlas <atlas@pr1ma.darkest.space>
Date: Sat, 6 Jun 2026 10:50:55 +0200
Subject: [PATCH] fix(matrix): give hive-matrix container a DNS resolver so
 tuwunel can boot

tuwunel hard-fails to start when /etc/resolv.conf has no nameserver
line (Failed to configure DNS resolver: no nameservers found in
config -> exit 1 -> systemd start-limit). The declarative
containers.hive-matrix generates its own resolv.conf via resolvconf
and, unlike agent containers whose resolv.conf is written by
hive-c0re's lifecycle, has no nameserver source -> it comes up empty
(just 'options edns0'). Defaulting network.enable on surfaced this:
the host DNS moved to the bridge dnsmasq but the container was never
pointed at it, so the homeserver could not boot, taking down matrix
for all agents.

Point the container at the hive resolver (the dnsmasq the network
module runs at bridgeIp) when the network module is enabled; the
container always shares the host netns (privateNetwork = false) so it
reaches bridgeIp whether or not isolateContainers is set. With the
network module off, inherit the host resolv.conf.
---
 nix/modules/hive-matrix.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix
index 9a6ddf9c..b63cd224 100644
--- a/nix/modules/hive-matrix.nix
+++ b/nix/modules/hive-matrix.nix
@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.services.hyperhive.matrix;
+  networkCfg = config.services.hyperhive.network;
   hyperhiveDomain = config.services.hyperhive.domain;
   effectiveServerName = if cfg.serverName != null then cfg.serverName else hyperhiveDomain;
 
@@ -337,6 +338,29 @@ in
         { ... }:
         {
           system.stateVersion = "26.05";
+
+          # tuwunel hard-fails to boot if `/etc/resolv.conf` has no
+          # `nameserver` line (`Failed to configure DNS resolver ... no
+          # nameservers found in config` → exit 1). This declarative
+          # nixos-container generates its own resolv.conf via resolvconf
+          # and — unlike agent containers, whose resolv.conf is written by
+          # hive-c0re's lifecycle — it has no nameserver source, so it
+          # comes up empty (just `options edns0`). When the hive network
+          # module is on, point it at the dnsmasq resolver the module runs
+          # at `bridgeIp`; this container always shares the host netns
+          # (`privateNetwork = false`), so it reaches `bridgeIp` whether or
+          # not `isolateContainers` is set. With the network module off,
+          # inherit the host's resolv.conf (which carries the host
+          # resolver). See `docs/network.md`.
+          networking = lib.mkMerge [
+            (lib.mkIf networkCfg.enable {
+              nameservers = [ networkCfg.bridgeIp ];
+            })
+            (lib.mkIf (!networkCfg.enable) {
+              useHostResolvConf = true;
+            })
+          ];
+
           services.matrix-tuwunel = {
             enable = true;
             package = cfg.package;