From 9902d9d9a54a67b2f03fa324d972ab5128ba6c9d Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Mon, 15 Jun 2026 13:32:01 +0200
Subject: [PATCH] fix(ci): resolve the forge domain to loopback in the hive-ci
 runner
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Forgejo's Actions artifact API hands the runner an upload URL built from
forgejo's ROOT_URL — the public forge domain (forge.<domain>), not the
runner's 127.0.0.1:<httpPort> registration URL. The hive-ci container shares
host netns but has no resolver entry for the hive's own domains (the
gateway's localHostsEntry only touches the host), so actions/upload-artifact
fails with 'getaddrinfo ENOTFOUND forge.<domain>' while normal CI (checkout
via the localhost registration URL) is unaffected. Add a networking.extraHosts
entry mapping the forge domain to loopback so the upload reaches the local
forge via the gateway.
---
 nix/modules/hive-ci.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index cbd27c22..b509aad8 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -336,6 +336,24 @@ in
         {
           system.stateVersion = "26.05";
 
+          # Resolve the hive's own forge domain to loopback inside the
+          # runner. The Forgejo Actions artifact API hands the runner an
+          # upload URL built from forgejo's ROOT_URL — the *public* forge
+          # domain (`forge.<domain>`), not the runner's
+          # `127.0.0.1:<httpPort>` registration URL. This container shares
+          # host netns but carries no resolver entry for the hive's own
+          # domains (the gateway's `localHostsEntry` only touches the host),
+          # so `actions/upload-artifact` dies with
+          #   Error: getaddrinfo ENOTFOUND forge.<domain>
+          # while normal CI is unaffected (checkout uses the localhost
+          # registration URL). Map the forge domain to loopback so the
+          # upload reaches the local forge — via the gateway on :80 when
+          # behindGateway, or forge directly on :httpPort otherwise. The
+          # gateway proxies all of `/` (artifact endpoints included), and a
+          # `localhost` domain (no hive-domain set) is already loopback, so
+          # this is a harmless no-op in that case.
+          networking.extraHosts = "127.0.0.1 ${forgeCfg.domain}";
+
           # nspawn containers can't create user-namespaces, so nix
           # sandboxing always fails. Fall back to unsandboxed builds.
           # See docs/gotchas.md.