vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(nix): fix stale 'localhost via shared netns' claim in forge openFirewall doc

Browse source 
Agents in private netns reach the forge at forge.<domain> via the
gateway, not via localhost directly. The conclusion (firewall only
matters for external access) is correct; the mechanism description
was stale from the pre-isolation era.
This commit is contained in:
atlas 2026-07-04 21:09:06 +02:00 • committed by mara
commit d7bed0052c
1 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/modules/hive-forge.nix
View file

@ -182,13 +182,12 @@ in
example = true; example = true;
description = '' description = ''
Open `httpPort` + `sshPort` in the host firewall. Off by Open `httpPort` + `sshPort` in the host firewall. Off by
default (secure-by-default): the forge is reachable from the default (secure-by-default): agent containers reach the forge
host + every agent container via `localhost` either way at `forge.<domain>` via the gateway (not directly), and the
(shared netns), so the firewall opens only matter for access host reaches it on loopback — so the firewall opens only
from outside the host. Flip to `true` when you want the matter for access from outside the host. Flip to `true` when
operator's browser / external git clients to hit the forge you want the operator's browser or external git clients to
directly. (The container shares host netns, so this is the hit the forge directly.
only firewall layer that matters.)
**Breaking change**: this used to default to `true`. If you **Breaking change**: this used to default to `true`. If you
relied on the old default for external reach, add relied on the old default for external reach, add