From aaf55b9c27cea9e119b10f0610ab5f3fb3835711 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 29 Aug 2026 12:41:25 +0200 Subject: [PATCH] docs: network.md + conventions.md no longer describe the removed toggle argus caught docs/network.md still listing HIVE_NETWORK_ISOLATION as a live c0re signal and saying hive-c0re reads it. Neither is true after this branch. conventions.md had the same shape one file over: it described write_dropins as writing PRIVATE_NETWORK=0. docs/gotchas.md has the same staleness and is deliberately untouched -- #3723 already rewrites that passage, and editing it here would conflict with a PR that has been reviewed five times. git grep now reports no HIVE_NETWORK_ISOLATION anywhere in tracked files. --- docs/conventions.md | 2 +- docs/network.md | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/conventions.md b/docs/conventions.md index 7b06bcc2..cbd3e46b 100644 --- a/docs/conventions.md +++ b/docs/conventions.md @@ -418,7 +418,7 @@ via `snapshotOpenDetails` / `restoreOpenDetails`. `job_queue::templates::rebuild` builds the DAG that reconciles a container to its wanted state: `write_dropins` (the nspawn-conf -rewrite — `PRIVATE_NETWORK=0`, clears `HOST_ADDRESS` / `LOCAL_ADDRESS`, +rewrite — `PRIVATE_NETWORK=1`, `HOST_ADDRESS` = the bridge gateway IP, sets `EXTRA_NSPAWN_FLAGS` — plus the systemd resource-limits drop-in) is folded into the `Swap` node, then `nixos-container update` + stop + start runs across the `StopForUpdate → Swap → RebuildBookkeeping` diff --git a/docs/network.md b/docs/network.md index 5ec8cd3b..4bfeb99e 100644 --- a/docs/network.md +++ b/docs/network.md @@ -209,7 +209,7 @@ the nix side sets up unconditionally: | Internet NAT | `networking.nat { enable = true; internalInterfaces = [ bridgeName ]; }` — MASQUERADE on packets leaving via any external NIC | | Loopback DROP | `networking.firewall.extraInputRules` — drops bridge-subnet → `127.0.0.0/8` traffic; defence-in-depth against routing table leaks | | Gateway access | `networking.firewall.interfaces..allowedTCPPorts = [ 80 443 ]` — lets isolated agents (private netns, veth on bridge) reach nginx on the host | -| c0re signal | `HIVE_NETWORK_ISOLATION=1`, `HIVE_NETWORK_BRIDGE`, `HIVE_NETWORK_SUBNET` in `systemd.services.hive-c0re.environment` | +| c0re signal | `HIVE_NETWORK_BRIDGE`, `HIVE_NETWORK_SUBNET` in `systemd.services.hive-c0re.environment` — both **required**; `hive-c0re` refuses to start without them | `HIVE_NETWORK_SUBNET` is the host-side bridge IP + prefix (e.g. `10.42.0.1/24`), **not** the canonical network address. The Rust side @@ -218,10 +218,14 @@ address arithmetic. ### What the Rust side does -`hive-c0re` reads `HIVE_NETWORK_ISOLATION` and passes +`hive-c0re` reads `HIVE_NETWORK_BRIDGE` + `HIVE_NETWORK_SUBNET` and passes `PRIVATE_NETWORK=1`, `LOCAL_ADDRESS=` (empty), `HOST_ADDRESS=`, and `HOST_BRIDGE=` via `lifecycle::set_nspawn_flags` when -creating or updating containers. `LOCAL_ADDRESS` is left empty so the +creating or updating containers. Both variables are validated **once at +daemon startup**, not per container: they are process-global, so a +missing or malformed value is a misconfigured daemon rather than one bad +container, and failing at boot gives a single diagnostic instead of one +per agent. There is no non-isolated mode to fall back to. `LOCAL_ADDRESS` is left empty so the container's dhcpcd acquires an address from the bridge dnsmasq pool (`networking.useDHCP = true` in `nix/agent-modules/network.nix`). This applies uniformly to all containers — agents and service containers alike.