vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: use forge domain URL + open 80/443 for isolated agents

Browse source 
when isolateContainers=true, isolated agents have dnsmasq as their
resolver — forge.<domain> resolves to bridgeIp. route HIVE_FORGE_URL
through nginx on port 80 instead of exposing the raw forge port.

- HIVE_FORGE_URL: http://<forge.domain> when isolated (nginx proxies)
- bridge firewall: open 80+443 for agents to reach nginx (gateway)
- remove forge-specific httpPort rule (no longer needed)
- update docs/gateway.md + docs/network.md

per mara's review comment on PR #1150.
This commit is contained in:
atlas 2026-06-03 16:10:32 +02:00 • committed by mara
commit 806d0e4a61
4 changed files with 28 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/network.md
View file

@ -95,6 +95,11 @@ agent containers.
interface only. Other interfaces stay closed. The hive resolver
isn't an external-facing service.
When `isolateContainers = true`, `allowedTCPPorts` is extended with
`[ 80 443 ]` so isolated agents can reach nginx (gateway container,
shared host netns) for the forge sub-domain, per-agent UI proxies,
and any other HTTP services.
## Container isolation
`services.hyperhive.network.isolateContainers` (default `false`) flips
@ -108,8 +113,8 @@ agent containers from shared host netns to private netns. Set only after
| IP forwarding | `boot.kernel.sysctl."net.ipv4.ip_forward" = 1` |
| Internet NAT | `networking.nat { enable = true; internalInterfaces = [ bridgeName ]; }` — MASQUERADE on packets leaving via any external NIC |
| Loopback DROP | `networking.firewall.extraInputRules` — drops bridge-subnet → `127.0.0.0/8` traffic; defence-in-depth against routing table leaks |
| Forge access | `networking.firewall.interfaces.<bridge>.allowedTCPPorts` — opens `forge.httpPort` on the bridge interface so isolated agents can reach forgejo at `<bridgeIp>:<httpPort>` |
| Forge URL | `HIVE_FORGE_URL` flips from `http://127.0.0.1:3000` to `http://<bridgeIp>:3000` — forwarded to containers via meta flake |
| Gateway access | `networking.firewall.interfaces.<bridge>.allowedTCPPorts = [ 80 443 ]` — lets isolated agents reach nginx on the host (shared netns) |
| Forge URL | `HIVE_FORGE_URL` flips from `http://127.0.0.1:3000` to `http://forge.<domain>` — agents resolve via dnsmasq, nginx proxies to forgejo |
| c0re signal | `HIVE_NETWORK_ISOLATION=1`, `HIVE_NETWORK_BRIDGE`, `HIVE_NETWORK_SUBNET` in `systemd.services.hive-c0re.environment` |
`HIVE_NETWORK_SUBNET` is the host-side bridge IP + prefix (e.g.