From a2a96490d3248c63fc87a10b935f65708faf717e Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 3 Jun 2026 16:13:03 +0200 Subject: [PATCH] fix: assert gateway.enable when isolateContainers + forge.enable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit isolated agents reach forge via http://forge. → nginx. without the gateway there is nothing on port 80 to serve that hostname. assert early rather than fail silently at runtime. addresses argus yellow note on PR #1150. --- nix/modules/hive-network.nix | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/nix/modules/hive-network.nix b/nix/modules/hive-network.nix index 69298e4f..1cce485a 100644 --- a/nix/modules/hive-network.nix +++ b/nix/modules/hive-network.nix @@ -196,6 +196,18 @@ in resolver must be running before isolation is flipped on). ''; } + { + assertion = + !config.services.hyperhive.forge.enable || config.services.hyperhive.gateway.enable; + message = '' + services.hyperhive.network.isolateContainers = true with + services.hyperhive.forge.enable = true requires + services.hyperhive.gateway.enable = true — isolated agents + reach the forge via `http://forge.` which nginx (in + the gateway container) proxies to forgejo. Without the gateway + there is nothing listening on port 80 to serve that hostname. + ''; + } ]; })