From 495146a05c6c637140803b171bdb2cbe9173cbb2 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 10 Jun 2026 21:01:13 +0200 Subject: [PATCH] fix(network): order isolated-DNS oneshot before the harness Follow-up to the isolated-container egress fix. The hyperhive-isolated-dns oneshot (which rewrites resolv.conf to the bridge resolver) was ordered before network-online.target + tea-login, but NOT relative to the harness (hive-ag3nt) or the matrix daemon. hive-ag3nt only declares `after network.target`, so on first boot its first-turn api.anthropic.com lookup could race ahead of the resolv.conf rewrite and error (self-heals next turn, but flaps the first one). Add hive-ag3nt.service + hive-matrix-daemon.service to the oneshot's `before` so DNS is fixed before any network consumer starts. The matrix entry is a harmless no-op when matrix is disabled (unit absent). Caught by damocles in review of the parent PR. --- nix/templates/harness-base.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix index 18278a49..80331efb 100644 --- a/nix/templates/harness-base.nix +++ b/nix/templates/harness-base.nix @@ -1040,9 +1040,19 @@ in description = "point resolv.conf at the hive bridge resolver (isolated containers)"; wantedBy = [ "multi-user.target" ]; after = [ "local-fs.target" ]; + # Ordered before every network consumer that does DNS on first + # boot. `hive-ag3nt` (the harness) is the load-bearing one: its + # first-turn api.anthropic.com lookup must not race the resolv.conf + # rewrite (it only declares `after network.target`, so without this + # edge the harness can start before we've fixed resolv.conf and the + # first turn errors — self-heals next turn, but better not to flap). + # `hive-matrix-daemon` likewise syncs over the network; the `before` + # is a harmless no-op when matrix is disabled (the unit is absent). before = [ "network-online.target" "tea-login.service" + "hive-ag3nt.service" + "hive-matrix-daemon.service" ]; unitConfig.ConditionPathExists = "/etc/hyperhive-bridge-dns"; serviceConfig = {