vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

matrix: drop the shared-netns claims the netns move left behind

Browse source 
network.md listed matrix among the shared-netns containers and the
private-netns list named only agents and the CI runner; it now says
every privateNetwork container keeps its own firewall. The authelia
module no longer calls the matrix container shared, and the hive-c0re
comment on having no homeserver fallback no longer names port 8008.

Part of #4815.
This commit is contained in:
atlas 2026-10-15 01:28:46 +02:00 • committed by mara
commit 85860d544d
3 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/networking/network.md
View file

@ -164,7 +164,7 @@ agent containers.
UI proxies, and any other HTTP services. UI proxies, and any other HTTP services.
The **host** firewall is the only firewall. The swarm service The **host** firewall is the only firewall. The swarm service
containers that share the host netns (forge, matrix, authelia, bao, the containers that share the host netns (forge, authelia, bao, the
metrics and log stores) run with `networking.firewall.enable = false` metrics and log stores) run with `networking.firewall.enable = false`
(`nix/container-modules/swarm-container.nix`): a NixOS firewall inside a (`nix/container-modules/swarm-container.nix`): a NixOS firewall inside a
shared-netns container runs against the _host_ ruleset — at container shared-netns container runs against the _host_ ruleset — at container
@ -172,7 +172,7 @@ boot its `firewall-start` flushes the `nixos-fw` chains, rebuilds them
from the container's (empty) port list, and deletes the host's from the container's (empty) port list, and deletes the host's
`nixos-nat-*` chains without recreating them, silently wiping the `nixos-nat-*` chains without recreating them, silently wiping the
bridge holes above plus the agents' NAT. Private-netns containers bridge holes above plus the agents' NAT. Private-netns containers
(agents, swarm-ci-runner) may keep their own firewall — it's scoped to their (every container with `privateNetwork = true`: agents and the service containers on the bridge) keep their own firewall — it's scoped to their
namespace. namespace.
### Reaching host services (`exposeHostPorts`) ### Reaching host services (`exposeHostPorts`)

2
hive-c0re/src/matrix.rs
View file

@ -18,7 +18,7 @@ use reqwest::StatusCode;
/// ///
/// `None` means **this hive has no homeserver to provision against** and /// `None` means **this hive has no homeserver to provision against** and
/// every matrix path no-ops — see [`is_present`]. There is deliberately no /// every matrix path no-ops — see [`is_present`]. There is deliberately no
/// fallback: `localhost:8008` is right only when the homeserver happens to /// fallback: a loopback default is right only when the homeserver happens to
/// share this daemon's netns, and an address baked into the binary is one /// share this daemon's netns, and an address baked into the binary is one
/// that builds fine and then talks to the wrong machine. The nix module /// that builds fine and then talks to the wrong machine. The nix module
/// defaults it to `https://` on the homeserver's gateway vhost, on every /// defaults it to `https://` on the homeserver's gateway vhost, on every

2
nix/host-modules/swarm-authelia.nix
View file

@ -492,7 +492,7 @@ let
mv ${lib.escapeShellArg "${clientsFile}.tmp"} ${lib.escapeShellArg clientsFile} mv ${lib.escapeShellArg "${clientsFile}.tmp"} ${lib.escapeShellArg clientsFile}
''; '';
# Shared host netns, like the forge and matrix containers: the # Shared host netns, like the forge container: the
# gateway reaches authelia at 127.0.0.1:<port>. # gateway reaches authelia at 127.0.0.1:<port>.
privateNetwork = false; privateNetwork = false;
in in