vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(matrix): point the tuwunel container resolver at the bridge dnsmasq

Browse source 
The hive-matrix nixos-container came up with an EMPTY /etc/resolv.conf
even with networking.nameservers set, so tuwunel hard-failed at boot
(no nameservers found). The nixos-container default useHostResolvConf=true
puts in-container resolvconf in host-tracking mode: it ignores
networking.nameservers and never receives the host resolv.conf across the
shared-netns boundary, so resolvconf regenerates an empty file.

When the hive network module is on, turn off host-tracking (mkForce, to
beat the module default) so resolvconf honours networking.nameservers,
pointing the resolver at the gateway-container dnsmasq at bridgeIp.
Network module off -> inherit the host resolv.conf.
This commit is contained in:
atlas 2026-06-06 12:57:02 +02:00 • committed by mara
commit 812a072e1c
1 changed files with 13 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/modules/hive-matrix.nix
View file

@ -342,18 +342,25 @@ in
# tuwunel hard-fails to boot if `/etc/resolv.conf` has no # tuwunel hard-fails to boot if `/etc/resolv.conf` has no
# `nameserver` line (`Failed to configure DNS resolver ... no # `nameserver` line (`Failed to configure DNS resolver ... no
# nameservers found in config` → exit 1). This declarative # nameservers found in config` → exit 1). This declarative
# nixos-container generates its own resolv.conf via resolvconf # nixos-container had it come up EMPTY (just `options edns0`)
# and — unlike agent containers, whose resolv.conf is written by # even with `networking.nameservers` set: the nixos-container
# hive-c0re's lifecycle — it has no nameserver source, so it # default `useHostResolvConf = true` puts in-container resolvconf
# comes up empty (just `options edns0`). When the hive network # in host-tracking mode, which ignores `networking.nameservers`
# module is on, point it at the dnsmasq resolver the module runs # and never receives the host's resolv.conf across the
# at `bridgeIp`; this container always shares the host netns # shared-netns boundary — so resolvconf regenerates an empty file
# and tuwunel dies at boot.
#
# When the hive network module is on, turn off host-tracking so
# resolvconf honours `networking.nameservers`, pointing the
# resolver at the dnsmasq the network module runs at `bridgeIp`.
# This container always shares the host netns
# (`privateNetwork = false`), so it reaches `bridgeIp` whether or # (`privateNetwork = false`), so it reaches `bridgeIp` whether or
# not `isolateContainers` is set. With the network module off, # not `isolateContainers` is set. With the network module off,
# inherit the host's resolv.conf (which carries the host # inherit the host's resolv.conf (which carries the host
# resolver). See `docs/network.md`. # resolver). See `docs/network.md`.
networking = lib.mkMerge [ networking = lib.mkMerge [
(lib.mkIf networkCfg.enable { (lib.mkIf networkCfg.enable {
useHostResolvConf = lib.mkForce false;
nameservers = [ networkCfg.bridgeIp ]; nameservers = [ networkCfg.bridgeIp ];
}) })
(lib.mkIf (!networkCfg.enable) { (lib.mkIf (!networkCfg.enable) {