From e3ef4a96303a1006c2c3bccf21aa69cae8ead9f8 Mon Sep 17 00:00:00 2001 From: damocles Date: Sat, 29 Aug 2026 12:08:19 +0200 Subject: [PATCH] docs/gotchas: drop mention of the branch slated for removal, describe only the real behavior --- docs/gotchas.md | 30 ++++++++---------------------- 1 file changed, 8 insertions(+), 22 deletions(-) diff --git a/docs/gotchas.md b/docs/gotchas.md index 9642bc4b..c63438f6 100644 --- a/docs/gotchas.md +++ b/docs/gotchas.md @@ -32,28 +32,14 @@ Not `boot.isContainer = true`. Renamed in nixos-25.11+. --network-veth` branch then forces a private netns — silently fatal for our web UIs (the bind is invisible from the host). `hive-priv`'s `write_nspawn_flags` rewrites these vars every time it -touches the conf file, and which way it writes them depends on -`HIVE_NETWORK_ISOLATION`: - -- **Every real deployment today**: `hive-network.nix` sets - `HIVE_NETWORK_ISOLATION=1` unconditionally whenever hyperhive is - enabled — there's no opt-out any more (`isolateContainers` and the - module's own `enable` option were both removed via - `lib.mkRemovedOptionModule`; "network isolation is the only mode" is - the removal message itself). So `write_nspawn_flags` takes the - `isolation: Some` branch: `PRIVATE_NETWORK=1` plus a veth pair onto - the host bridge, `HOST_ADDRESS` set to the bridge gateway IP (so - `nixos-container`'s in-container init installs a default route - before the DHCP lease arrives), rest left for DHCP. -- The `None` branch — force-clear `HOST_ADDRESS` / `LOCAL_ADDRESS` / - `HOST_ADDRESS6` / `LOCAL_ADDRESS6` / `HOST_BRIDGE` and - `PRIVATE_NETWORK=0` — only fires when `HIVE_NETWORK_ISOLATION` isn't - `"1"` at all (env var unset) or the bridge subnet fails to parse - (`bridge_gateway_ip` returns `None`, logged as a warning). This isn't - a supported alternate mode, it's residual code from before isolation - was mandatory — see hyperhive#3725 for removing it (and deciding - what an unset env var / unparseable subnet should do instead of - silently degrading to non-isolated). +touches the conf file: `PRIVATE_NETWORK=1` plus a veth pair onto the +host bridge, `HOST_ADDRESS` set to the bridge gateway IP (so +`nixos-container`'s in-container init installs a default route before +the DHCP lease arrives), rest left for DHCP. Network isolation is the +hive's only mode (`hive-network.nix` sets it up unconditionally +whenever hyperhive is enabled; `isolateContainers` and the module's own +`enable` option were both removed via `lib.mkRemovedOptionModule` — +"network isolation is the only mode" is the removal message itself). ### systemd service PATH ≠ host PATH