vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: use forge domain URL + open 80/443 for isolated agents

Browse source 
when isolateContainers=true, isolated agents have dnsmasq as their
resolver — forge.<domain> resolves to bridgeIp. route HIVE_FORGE_URL
through nginx on port 80 instead of exposing the raw forge port.

- HIVE_FORGE_URL: http://<forge.domain> when isolated (nginx proxies)
- bridge firewall: open 80+443 for agents to reach nginx (gateway)
- remove forge-specific httpPort rule (no longer needed)
- update docs/gateway.md + docs/network.md

per mara's review comment on PR #1150.
This commit is contained in:
atlas 2026-06-03 16:10:32 +02:00 • committed by mara
commit 806d0e4a61
4 changed files with 28 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

14
nix/modules/hive-c0re.nix
View file

@ -557,17 +557,17 @@ in
HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarmName;
}
// lib.optionalAttrs config.services.hyperhive.forge.enable {
# In-cluster forge URL. When containers are isolated (private netns),
# 127.0.0.1 is the container's own loopback — unreachable for host
# services. Use the bridge gateway IP instead; forgejo binds 0.0.0.0
# so it's reachable there. Shared-netns mode keeps loopback path.
# External `forge.<hive>` sub-domain isn't DNS-resolvable from inside
# nspawn either way. See `docs/gateway.md::HIVE_FORGE_URL`.
# In-cluster forge URL.
# - Isolated (private netns): containers resolve `forge.<domain>` via
# the bridge dnsmasq and reach nginx on port 80. No raw forge port
# needed — nginx proxies to forgejo as it does for the operator.
# - Shared netns: host loopback is reachable, use direct port.
# See `docs/gateway.md::HIVE_FORGE_URL`.
HIVE_FORGE_URL =
if
config.services.hyperhive.network.enable && config.services.hyperhive.network.isolateContainers
then
"http://${config.services.hyperhive.network.bridgeIp}:${toString config.services.hyperhive.forge.httpPort}"
"http://${config.services.hyperhive.forge.domain}"
else
"http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}";
}

17
nix/modules/hive-network.nix
View file

@ -215,16 +215,13 @@ in
ip saddr ${cfg.bridgeIp}/${toString cfg.bridgePrefixLength} ip daddr 127.0.0.0/8 drop
'';
# Allow isolated agents to reach the forge via the bridge gateway IP.
# Forgejo binds 0.0.0.0 so it's reachable at `bridgeIp:httpPort` from
# inside agent containers; without this rule the default INPUT policy
# drops the connection before it reaches forgejo. Only added when forge
# is enabled — no-op otherwise.
networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts =
lib.optionals config.services.hyperhive.forge.enable
[
config.services.hyperhive.forge.httpPort
];
# Allow isolated agents to reach the gateway (nginx on the host, shared
# netns). Port 80 covers `http://forge.<domain>`, per-agent UI proxies,
# and any other HTTP services the gateway fronts. Port 443 for HTTPS.
networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts = [
80
443
];
# Tells hive-c0re to pass PRIVATE_NETWORK + bridge settings to each
# container. HIVE_NETWORK_SUBNET is host-bridge IP/prefix, not canonical