From 50605851f4a09f35a009ce797d89c5a696bdb0e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?m=C3=BCde?= Date: Tue, 11 Aug 2026 23:25:28 +0200 Subject: [PATCH] fix(3088): stop dnsmasq shadowing hive DNS with the host's /etc/hosts localHostsEntry's 127.0.0.1 rows leak into the address= answers dnsmasq gives agent containers now that it runs on the host, sending every agent back to itself instead of the bridge IP. --- nix/host-modules/hive-gateway/dnsmasq.nix | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/nix/host-modules/hive-gateway/dnsmasq.nix b/nix/host-modules/hive-gateway/dnsmasq.nix index 7a136ca8..b212309a 100644 --- a/nix/host-modules/hive-gateway/dnsmasq.nix +++ b/nix/host-modules/hive-gateway/dnsmasq.nix @@ -27,6 +27,20 @@ ]; bind-interfaces = true; port = 53; + # Authoritative for the hive domain via the `address` rules below — + # must not fall back to the host's /etc/hosts. dnsmasq reads + # /etc/hosts by default, and `gateway.localHostsEntry` populates it + # with 127.0.0.1 for every hive name (host-side dev convenience, + # see default.nix). Since #3088 moved dnsmasq onto the host, that + # file is now the *same* /etc/hosts dnsmasq reads for agent queries + # — its entries win over `address=`, so every agent resolves the + # hive's own domains back to itself (127.0.0.1 in its own netns) + # instead of the bridge IP, and can't reach the forge, matrix, or + # dashboard at all. `no-hosts = true` keeps the authoritative + # `address=` rules in charge for containers while leaving + # `networking.hosts` (the actual /etc/hosts entries) untouched for + # host-side browsing. + no-hosts = true; # Hive authoritative records — answer queries for the hive domain # + its sub-domains with the bridge IP, where nginx is reachable # from every container netns.