vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nix: give the gateway, resolver and bridge their own enable

Browse source 
`services.hyperhive.gateway.enable`, `gateway.dns.enable` and
`network.enable` replace the `hyperhive.enable` gate on all three. Each
defaults to false; the modules that need one assert it with `mkDefault
true` from inside the guard their own deployment already carries, and
`swarm-required-services.nix` — the module that owns what the
swarm-services toggle implies — asserts all three explicitly.

hive-c0re asserts all three unconditionally, so an ordinary hive keeps
getting them with no opt-in: it is the host's only knowledge that agent
containers exist.

The resolver moves to its own `hive-gateway/dns.nix` so it can be gated
without reindenting the nginx half of the module.

Reinstates `network.enable`, dropping its `mkRemovedOptionModule` shim.
A config still carrying `network.enable = false` from before the removal
now switches the bridge off instead of failing eval.

Also deletes a duplicate `centralToggleOff` fixture in nix/module-eval.nix.
Two sibling slices added it independently (c5f60fd5, ce3b3d94); the merge
was textually clean and left `main` failing to evaluate at all, so this
file could not be gated without removing one.
This commit is contained in:
atlas 2026-09-19 13:45:55 +02:00 • committed by mara
commit d8e26a17bb
21 changed files with 249 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

34
nix/host-modules/hive-network.nix
View file

@ -29,16 +29,10 @@ let
networkBase = builtins.bitAnd (ipToInt cfg.bridgeIp) (4294967295 - hostCount + 1);
in
{
# Hive-internal network — host-side bridge + per-agent DNS resolver.
# Always active when hyperhive is enabled: agent containers run in
# private netns behind the bridge. Full design: docs/networking/network.md.
# Hive-internal network — the host-side bridge every container in a
# private netns hangs off. Full design: docs/networking/network.md.
imports = [
(lib.mkRemovedOptionModule [ "services" "hyperhive" "network" "enable" ] ''
The hive network (bridge + dnsmasq resolver + private-netns
isolation) is always on whenever hyperhive is enabled. Remove the
setting.
'')
(lib.mkRemovedOptionModule [ "services" "hyperhive" "network" "isolateContainers" ] ''
Network isolation is the only mode and is always on whenever
hyperhive is enabled; the shared-netns path was removed. Remove
@ -52,6 +46,12 @@ in
];
options.services.hyperhive.network = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Bring up the hive bridge, its NAT and its firewall rules on this host.";
};
bridgeName = lib.mkOption {
type = lib.types.str;
default = "hive-br0";
@ -148,9 +148,10 @@ in
};
config = lib.mkMerge [
# The hive network + container isolation are unconditional whenever
# hyperhive is enabled: the shared-netns mode was removed, so there
# is one mode (private netns behind the bridge).
# Identity checks belong to hyperhive being on, not to the bridge
# being up: a hive with no domain is misconfigured either way, and
# moving them under the bridge gate would hide them on exactly the
# hosts that are hardest to debug.
(lib.mkIf config.services.hyperhive.enable {
# This message is only useful if an operator can actually reach
# it, and an assertion competes with every eager default that
@ -206,7 +207,11 @@ in
'';
}
];
})
# The bridge itself, up only where something hangs off it. Private
# netns is still the only container mode.
(lib.mkIf cfg.enable {
# Virtual bridge — each agent container attaches a veth pair (isolation
# is unconditional now).
networking.bridges.${cfg.bridgeName}.interfaces = [ ];
@ -233,9 +238,10 @@ in
};
})
# Container isolation overlay — now unconditional (the shared-netns
# mode was removed). See docs/networking/network.md#container-isolation.
(lib.mkIf config.services.hyperhive.enable {
# Container isolation overlay — the routing, NAT and firewall half of
# the same bridge, so it rides the same gate.
# See docs/networking/network.md#container-isolation.
(lib.mkIf cfg.enable {
# Agents route internet traffic via the bridge; NAT masquerades their RFC-1918 IPs.
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;