vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(nix): fix stale 'localhost via shared netns' claim in forge openFirewall doc

Browse source 
Agents in private netns reach the forge at forge.<domain> via the
gateway, not via localhost directly. The conclusion (firewall only
matters for external access) is correct; the mechanism description
was stale from the pre-isolation era.
This commit is contained in:
atlas 2026-07-04 21:09:06 +02:00 • committed by mara
commit d7bed0052c
1 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/modules/hive-forge.nix
View file

@ -182,13 +182,12 @@ in
example = true;
description = ''
Open `httpPort` + `sshPort` in the host firewall. Off by
default (secure-by-default): the forge is reachable from the
host + every agent container via `localhost` either way
(shared netns), so the firewall opens only matter for access
from outside the host. Flip to `true` when you want the
operator's browser / external git clients to hit the forge
directly. (The container shares host netns, so this is the
only firewall layer that matters.)
default (secure-by-default): agent containers reach the forge
at `forge.<domain>` via the gateway (not directly), and the
host reaches it on loopback — so the firewall opens only
matter for access from outside the host. Flip to `true` when
you want the operator's browser or external git clients to
hit the forge directly.
**Breaking change**: this used to default to `true`. If you
relied on the old default for external reach, add