vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: use forge domain URL + open 80/443 for isolated agents

Browse source 
when isolateContainers=true, isolated agents have dnsmasq as their
resolver — forge.<domain> resolves to bridgeIp. route HIVE_FORGE_URL
through nginx on port 80 instead of exposing the raw forge port.

- HIVE_FORGE_URL: http://<forge.domain> when isolated (nginx proxies)
- bridge firewall: open 80+443 for agents to reach nginx (gateway)
- remove forge-specific httpPort rule (no longer needed)
- update docs/gateway.md + docs/network.md

per mara's review comment on PR #1150.
This commit is contained in:
atlas 2026-06-03 16:10:32 +02:00 • committed by mara
commit 806d0e4a61
4 changed files with 28 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/gateway.md
View file

@ -200,27 +200,22 @@ dashboard reach by design — the surface is privileged (approve /
deny / destroy) and must not be exposed without a real reverse
proxy in front.
## `HIVE_FORGE_URL`: bridge gateway for isolated agents, loopback for shared-netns
## `HIVE_FORGE_URL`: domain via gateway for isolated agents, loopback for shared-netns
Agents poll `HIVE_FORGE_URL` for Forgejo notifications + run all
`hive-forge` calls against it. `hive-c0re.nix` sets this based on the
network isolation mode:
- **`network.isolateContainers = true`**: agents run in private netns,
so host loopback is unreachable. `HIVE_FORGE_URL` is set to
`http://<bridgeIp>:<forge.httpPort>`. Forgejo binds `0.0.0.0` so it's
reachable at the bridge gateway IP. `hive-network.nix` opens
`forge.httpPort` on the bridge interface automatically.
- **`network.isolateContainers = true`**: agents run in private netns and
get the bridge dnsmasq as their resolver. `HIVE_FORGE_URL` is set to
`http://<forge.domain>` (default `forge.<hive-domain>`). Agents resolve
the hostname via dnsmasq → bridge IP, then reach nginx on port 80 (bridge
firewall opens 80+443 when isolation is on). nginx proxies to forgejo — the
same path an operator browser takes, no raw port exposure needed.
- **`network.isolateContainers = false`** (default): agents share the host's
network namespace, so loopback reaches forgejo directly. `HIVE_FORGE_URL`
is `http://127.0.0.1:<forge.httpPort>`.
The sub-domain default (`forge.<hive-domain>`) is for **operator
browsers + cross-host clients**, not in-cluster traffic. Using the
sub-domain URL inside agent containers would fail every `hive-forge`
invocation with "Name or service not known" — the agent's nspawn
doesn't have DNS for the external hostname.
## hive-forge container shape
Private Forgejo wrapped in a nixos-container (`hive-forge`, not