vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(#2363): grant hive-gateway CAP_NET_ADMIN — dnsmasq DHCP mode requires it

Browse source
This commit is contained in:
müde 2026-07-13 13:57:37 +02:00
commit 3a3f318779
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/modules/hive-gateway.nix
View file

@ -481,6 +481,14 @@ in
# port-forward dance, and the firewall config below is the only # port-forward dance, and the firewall config below is the only
# layer that matters. # layer that matters.
privateNetwork = false; privateNetwork = false;
# dnsmasq refuses to start once a dhcp-range is configured unless it
# holds CAP_NET_ADMIN (DNS-only mode doesn't need it). Private-network
# containers retain NET_ADMIN implicitly, but this container shares the
# host netns (above), so nspawn's default bounding set drops it — grant
# it explicitly. Note this is NET_ADMIN over the *host* netns; the
# gateway container is trusted infra (it already terminates TLS and
# fronts every vhost), so no new trust boundary is crossed.
additionalCapabilities = [ "CAP_NET_ADMIN" ];
# Bind-mount the per-agent socket dir so nginx inside the gateway # Bind-mount the per-agent socket dir so nginx inside the gateway
# container can `connect(2)` to the UDS upstreams. # container can `connect(2)` to the UDS upstreams.
# Read-only (we just connect; harness writes the socket inside # Read-only (we just connect; harness writes the socket inside