From 49470374545364a9b61434d3abad35df38db1b59 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 4 Jul 2026 21:57:26 +0200 Subject: [PATCH] chore(nix): trim stale body from deprecated isolateContainers option doc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The option is a no-op (marked DEPRECATED — ignored); the Prerequisite, Migration, and Rust counterpart sections all described the migration that already completed. Strip to just the deprecation notice. Also fix the bridgeIp description: 'once netns isolation lands' is past tense — isolation is unconditional now. Rephrase to present tense. --- nix/modules/hive-network.nix | 50 ++++-------------------------------- 1 file changed, 5 insertions(+), 45 deletions(-) diff --git a/nix/modules/hive-network.nix b/nix/modules/hive-network.nix index 0dcca3d8..e2c23cf6 100644 --- a/nix/modules/hive-network.nix +++ b/nix/modules/hive-network.nix @@ -51,11 +51,11 @@ in example = "172.30.0.1"; description = '' IPv4 address assigned to the bridge interface on the host - side. Becomes the DNS server address agents point at (and - the upstream the gateway proxies to once netns isolation - lands). Default `10.42.0.1` is in RFC 1918 space and - unlikely to clash with operator's existing setup; override - if a different range is already in use. + side. Agents use this address as their DNS server (dnsmasq + in the gateway container binds here). Default `10.42.0.1` + is in RFC 1918 space and unlikely to clash with operator's + existing setup; override if a different range is already in + use. ''; }; @@ -127,46 +127,6 @@ in removed. This option is retained as a no-op so existing configs eval; setting it to `false` warns and has no effect. It will be removed in a future release. - - Each agent container gets a dedicated veth - pair attached to `bridgeName` and a deterministic IP from - the bridge subnet. The bridge (already up when `enable = true`) - becomes the sole routed path between the host and agent - containers. - - The host-side nix effect (this option) is: - - Sets `HIVE_NETWORK_ISOLATION=1` in the c0re service env so - the Rust lifecycle knows to pass `--private-network` + - bridge settings when creating/updating containers. - - Enables IP forwarding + NAT so agents can reach the internet - through the host. - - Adds a firewall rule DROP'ing traffic from the bridge subnet - to the host's loopback addresses — defence-in-depth so a - compromised agent can't reach the c0re dashboard (already - bound to 127.0.0.1) or other host-loopback services even if - the routing table somehow leaks. - - Allows HTTP/HTTPS (80/443) traffic from the bridge subnet to - the host so agents can reach the gateway container (shared - host netns, proxies the operator's per-agent UI). - - **Prerequisite**: all agents must have - `hyperhive.web.useUnixSocket = true` before enabling isolation. - Agents that still bind TCP on `0.0.0.0:` will be - reachable at their bridge IP from other agents on the same - subnet — defeating the isolation goal. The gateway routes via - unix sockets so gateway reach still works regardless. - - **Migration**: containers are destroyed and re-created when - the network isolation flag flips. Operator state under - `/agents//state/` is bind-mounted and survives; the - container rootfs (nix store paths) is recreated cleanly. - - **Rust counterpart**: `hive-c0re` reads `HIVE_NETWORK_ISOLATION` - and `HIVE_NETWORK_BRIDGE` from its service env and uses them in - `lifecycle::set_nspawn_flags` to configure `PRIVATE_NETWORK`, - `LOCAL_ADDRESS`, and `HOST_BRIDGE` in each container's - `nixos-containers/.conf`. See `docs/network.md` for the - full design. ''; }; };