From 75dbcc2aa2f56d408ad7f8dc718c264ea8cef870 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 17 Jun 2026 16:58:20 +0200
Subject: [PATCH] nix(c0re): trim the network-isolation narrative from the
 forge/matrix URL comments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per mara's review of #1718: the HIVE_FORGE_URL / HIVE_MATRIX_URL comments
carried "network isolation is now unconditional / shared-netns removed"
backstory that doesn't belong on those keys. Trimmed to describe just the
value (the gateway vhost) + the gatewayHost null-guard. The
isolation-removal narrative stays where it's on-topic — the network
module's own deprecated-option descriptions and warning text.
---
 nix/modules/hive-c0re.nix | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index c141f771..90d1a22d 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -750,24 +750,18 @@ in
         HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarmName;
       }
       // lib.optionalAttrs config.services.hyperhive.forge.enable {
-        # In-cluster forge URL. Network isolation is unconditional (the
-        # shared-netns mode was removed), so agents always resolve
-        # `forge.<domain>` via the bridge dnsmasq and reach nginx on port 80
-        # (nginx proxies to forgejo as it does for the operator) — there is
-        # no host-loopback path. This env is only set when hyperhive is
-        # enabled, so the gateway URL is unconditionally correct here.
-        # See `docs/gateway.md::HIVE_FORGE_URL`.
+        # In-cluster forge URL — the gateway vhost (`forge.<domain>`), which
+        # nginx proxies to forgejo. Set directly: this env only exists when
+        # hyperhive is enabled. See `docs/gateway.md::HIVE_FORGE_URL`.
         HIVE_FORGE_URL = "http://${config.services.hyperhive.forge.domain}";
       }
       // lib.optionalAttrs config.services.hyperhive.matrix.enable {
         # In-cluster matrix homeserver URL for each agent's
-        # hive-matrix-daemon — the gateway vhost (`matrix.<domain>`) on plain
-        # http:80. Network isolation is unconditional, so there is no
-        # host-loopback path; the only remaining conditional is the
-        # gatewayHost null-guard, which falls back to loopback so a
-        # domain-less config still evals. Forwarded to agents by meta.rs
-        # alongside HIVE_FORGE_URL; shares the same env-forwarding ordering
-        # caveat (value baked at config-generation time).
+        # hive-matrix-daemon — the gateway vhost (`matrix.<domain>`). The
+        # gatewayHost null-guard falls back to loopback so a domain-less
+        # config still evals. Forwarded to agents by meta.rs alongside
+        # HIVE_FORGE_URL; shares the same env-forwarding ordering caveat
+        # (value baked at config-generation time).
         HIVE_MATRIX_URL =
           if config.services.hyperhive.matrix.gatewayHost != null then
             "http://${config.services.hyperhive.matrix.gatewayHost}"