From bb732a106c5e7122b4006eb5c6ca68c84bb9a997 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 29 Aug 2026 12:46:34 +0200 Subject: [PATCH] hive-priv, hive-c0re: two more doc comments describing the deleted branch set_nspawn_flags said PRIVATE_NETWORK was forced 0 for web-UI reachability; it is now unconditionally 1 and the UI is reached over the bridge. write_bridge_dns_marker said it writes or removes the marker; the removal path went with the host-netns case. Neither was reachable by the sweeps that found the earlier ones: this prose describes the *value in words* ('forced 0'), not the code's literal PRIVATE_NETWORK=0, and neither names the env var. Found by reading the doc comment of every function whose body this branch changed. --- hive-c0re/src/lifecycle/host_config.rs | 9 ++++++--- hive-priv/src/main.rs | 7 ++++--- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/hive-c0re/src/lifecycle/host_config.rs b/hive-c0re/src/lifecycle/host_config.rs index 2064d501..4768d493 100644 --- a/hive-c0re/src/lifecycle/host_config.rs +++ b/hive-c0re/src/lifecycle/host_config.rs @@ -131,9 +131,12 @@ fn bind_child_agent_dirs(child: &str, binds: &mut Vec) { } /// Idempotently rewrite the lines in `/etc/nixos-containers/.conf` -/// that hive-c0re owns: `PRIVATE_NETWORK` (forced 0 so the agent's web UI port -/// is reachable on the host) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir bind). -/// The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the +/// that hive-c0re owns: `PRIVATE_NETWORK` (always 1 — every container runs in +/// its own network namespace with a veth on the host bridge, and the agent's +/// web UI is reached over that bridge rather than a host-shared netns), +/// `HOST_ADDRESS` (the bridge gateway IP, so the container installs a default +/// route before DHCP completes) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir +/// bind). The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the /// `systemd-nspawn` command. #[allow( clippy::too_many_lines, diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs index 8fc3305f..bf44cf7a 100644 --- a/hive-priv/src/main.rs +++ b/hive-priv/src/main.rs @@ -2808,9 +2808,10 @@ fn bridge_dns_marker_path(container: &str) -> String { format!("/var/lib/nixos-containers/{container}/etc/hyperhive-bridge-dns") } -/// Write (isolated) or remove (host-netns) the bridge-DNS marker the -/// `hyperhive-isolated-dns` oneshot keys off. The marker file contains -/// just the gateway IP. Best-effort on removal (absence is the goal). +/// Write the bridge-DNS marker the `hyperhive-isolated-dns` oneshot keys +/// off. The marker file contains just the gateway IP. Always written: +/// every container is isolated, so there is no host-netns case that +/// wants the marker absent. fn write_bridge_dns_marker(container: &str, isolation: &NetworkIsolation) -> Result<()> { let path = bridge_dns_marker_path(container); // On a fresh install the container's `/etc` may not exist yet