From 85860d544d678996ce0c7868671f0cf2d7fa4ef1 Mon Sep 17 00:00:00 2001 From: atlas Date: Thu, 15 Oct 2026 01:28:46 +0200 Subject: [PATCH] matrix: drop the shared-netns claims the netns move left behind network.md listed matrix among the shared-netns containers and the private-netns list named only agents and the CI runner; it now says every privateNetwork container keeps its own firewall. The authelia module no longer calls the matrix container shared, and the hive-c0re comment on having no homeserver fallback no longer names port 8008. Part of #4815. --- docs/networking/network.md | 4 ++-- hive-c0re/src/matrix.rs | 2 +- nix/host-modules/swarm-authelia.nix | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/networking/network.md b/docs/networking/network.md index 80ae48e0..f2f828c3 100644 --- a/docs/networking/network.md +++ b/docs/networking/network.md @@ -164,7 +164,7 @@ agent containers. UI proxies, and any other HTTP services. The **host** firewall is the only firewall. The swarm service -containers that share the host netns (forge, matrix, authelia, bao, the +containers that share the host netns (forge, authelia, bao, the metrics and log stores) run with `networking.firewall.enable = false` (`nix/container-modules/swarm-container.nix`): a NixOS firewall inside a shared-netns container runs against the _host_ ruleset — at container @@ -172,7 +172,7 @@ boot its `firewall-start` flushes the `nixos-fw` chains, rebuilds them from the container's (empty) port list, and deletes the host's `nixos-nat-*` chains without recreating them, silently wiping the bridge holes above plus the agents' NAT. Private-netns containers -(agents, swarm-ci-runner) may keep their own firewall — it's scoped to their +(every container with `privateNetwork = true`: agents and the service containers on the bridge) keep their own firewall — it's scoped to their namespace. ### Reaching host services (`exposeHostPorts`) diff --git a/hive-c0re/src/matrix.rs b/hive-c0re/src/matrix.rs index 143aaeda..803a259a 100644 --- a/hive-c0re/src/matrix.rs +++ b/hive-c0re/src/matrix.rs @@ -18,7 +18,7 @@ use reqwest::StatusCode; /// /// `None` means **this hive has no homeserver to provision against** and /// every matrix path no-ops — see [`is_present`]. There is deliberately no -/// fallback: `localhost:8008` is right only when the homeserver happens to +/// fallback: a loopback default is right only when the homeserver happens to /// share this daemon's netns, and an address baked into the binary is one /// that builds fine and then talks to the wrong machine. The nix module /// defaults it to `https://` on the homeserver's gateway vhost, on every diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix index 463dd855..082aa2fb 100644 --- a/nix/host-modules/swarm-authelia.nix +++ b/nix/host-modules/swarm-authelia.nix @@ -492,7 +492,7 @@ let mv ${lib.escapeShellArg "${clientsFile}.tmp"} ${lib.escapeShellArg clientsFile} ''; - # Shared host netns, like the forge and matrix containers: the + # Shared host netns, like the forge container: the # gateway reaches authelia at 127.0.0.1:. privateNetwork = false; in