vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-priv, hive-c0re: two more doc comments describing the deleted branch

Browse source 
set_nspawn_flags said PRIVATE_NETWORK was forced 0 for web-UI
reachability; it is now unconditionally 1 and the UI is reached over the
bridge. write_bridge_dns_marker said it writes or removes the marker;
the removal path went with the host-netns case.

Neither was reachable by the sweeps that found the earlier ones: this
prose describes the *value in words* ('forced 0'), not the code's
literal PRIVATE_NETWORK=0, and neither names the env var. Found by
reading the doc comment of every function whose body this branch
changed.
This commit is contained in:
atlas 2026-08-29 12:46:34 +02:00 • committed by mara
commit bb732a106c
2 changed files with 10 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hive-c0re/src/lifecycle/host_config.rs
View file

@ -131,9 +131,12 @@ fn bind_child_agent_dirs(child: &str, binds: &mut Vec<BindMount>) {
}
/// Idempotently rewrite the lines in `/etc/nixos-containers/<container>.conf`
/// that hive-c0re owns: `PRIVATE_NETWORK` (forced 0 so the agent's web UI port
/// is reachable on the host) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir bind).
/// The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the
/// that hive-c0re owns: `PRIVATE_NETWORK` (always 1 — every container runs in
/// its own network namespace with a veth on the host bridge, and the agent's
/// web UI is reached over that bridge rather than a host-shared netns),
/// `HOST_ADDRESS` (the bridge gateway IP, so the container installs a default
/// route before DHCP completes) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir
/// bind). The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the
/// `systemd-nspawn` command.
#[allow(
clippy::too_many_lines,

7
hive-priv/src/main.rs
View file

@ -2808,9 +2808,10 @@ fn bridge_dns_marker_path(container: &str) -> String {
format!("/var/lib/nixos-containers/{container}/etc/hyperhive-bridge-dns")
}
/// Write (isolated) or remove (host-netns) the bridge-DNS marker the
/// `hyperhive-isolated-dns` oneshot keys off. The marker file contains
/// just the gateway IP. Best-effort on removal (absence is the goal).
/// Write the bridge-DNS marker the `hyperhive-isolated-dns` oneshot keys
/// off. The marker file contains just the gateway IP. Always written:
/// every container is isolated, so there is no host-netns case that
/// wants the marker absent.
fn write_bridge_dns_marker(container: &str, isolation: &NetworkIsolation) -> Result<()> {
let path = bridge_dns_marker_path(container);
// On a fresh install the container's `/etc` may not exist yet