From d7bed0052c78cec4ed72d516d397be69d859698f Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 4 Jul 2026 21:09:06 +0200 Subject: [PATCH] chore(nix): fix stale 'localhost via shared netns' claim in forge openFirewall doc Agents in private netns reach the forge at forge. via the gateway, not via localhost directly. The conclusion (firewall only matters for external access) is correct; the mechanism description was stale from the pre-isolation era. --- nix/modules/hive-forge.nix | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/nix/modules/hive-forge.nix b/nix/modules/hive-forge.nix index c59e4d9a..bea00e7a 100644 --- a/nix/modules/hive-forge.nix +++ b/nix/modules/hive-forge.nix @@ -182,13 +182,12 @@ in example = true; description = '' Open `httpPort` + `sshPort` in the host firewall. Off by - default (secure-by-default): the forge is reachable from the - host + every agent container via `localhost` either way - (shared netns), so the firewall opens only matter for access - from outside the host. Flip to `true` when you want the - operator's browser / external git clients to hit the forge - directly. (The container shares host netns, so this is the - only firewall layer that matters.) + default (secure-by-default): agent containers reach the forge + at `forge.` via the gateway (not directly), and the + host reaches it on loopback — so the firewall opens only + matter for access from outside the host. Flip to `true` when + you want the operator's browser or external git clients to + hit the forge directly. **Breaking change**: this used to default to `true`. If you relied on the old default for external reach, add