refactor: split hive-gateway into module dir, DHCP range into hive-network

nix/modules/hive-gateway/dnsmasq.nix

@@ -0,0 +1,59 @@
+# Hive-internal DNS resolver + DHCP, co-located in the gateway
+# container — single front-door for both DNS and HTTP, saves a
+# sibling container. Listens on the bridge interface from
+# `services.hyperhive.network`; authoritative for the hive domain +
+# sub-domains, forwards everything else upstream. Returns the
+# `services.dnsmasq` value for the container config (see
+# ./default.nix); the DHCP pool bounds are computed by hive-network.
+{
+  lib,
+  networkCfg,
+  forgeCfg,
+  matrixCfg,
+  hyperhiveDomain,
+}:
+{
+  enable = true;
+  # Don't substitute the container's /etc/resolv.conf — the gateway
+  # uses the host's resolver for its own outbound traffic; dnsmasq is
+  # purely for incoming queries from agent containers.
+  resolveLocalQueries = false;
+  settings = {
+    # Bind only on the bridge interface (and lo for health-checks).
+    # Outside hosts can't even see the listener.
+    interface = [
+      networkCfg.bridgeName
+      "lo"
+    ];
+    bind-interfaces = true;
+    port = 53;
+    # Don't read /etc/resolv.conf — we control upstream explicitly to
+    # dodge dependency on the gateway container's own resolver state.
+    no-resolv = true;
+    server = networkCfg.upstreamDns;
+    # Hive authoritative records — answer queries for the hive domain
+    # + its sub-domains with the bridge IP, where nginx is reachable
+    # from every container netns.
+    #
+    # The forge / matrix entries are redundant in the common case
+    # where `forge.domain` / `matrix.gatewayHost` are sub-domains of
+    # `hyperhive.domain` — dnsmasq's `/<domain>/` rule already matches
+    # sub-domains. Kept explicit because operators can override either
+    # to a cross-domain hostname (e.g. `forge.domain =
+    # "git.example.com"`); listing them explicitly keeps that case
+    # routed without needing an extra config block.
+    address = [
+      "/${hyperhiveDomain}/${networkCfg.bridgeIp}"
+    ]
+    ++ lib.optional ((forgeCfg.behindGateway or false)) "/${forgeCfg.domain}/${networkCfg.bridgeIp}"
+    ++ lib.optional (
+      matrixCfg.enable && matrixCfg.gatewayHost != null
+    ) "/${matrixCfg.gatewayHost}/${networkCfg.bridgeIp}";
+    # DHCP pool covering all usable host addresses on the bridge
+    # subnet — bounds computed by hive-network.nix from
+    # bridgeIp/bridgePrefixLength. All containers (agents and service
+    # containers such as hive-ci) receive their IPs dynamically.
+    dhcp-range = "${networkCfg.dhcpRangeStart},${networkCfg.dhcpRangeEnd},1h";
+    dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
+  };
+}