vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs/gotchas: drop mention of the branch slated for removal, describe only the real behavior

Browse source
This commit is contained in:
damocles 2026-08-29 12:08:19 +02:00 • committed by mara
commit e3ef4a9630
1 changed files with 8 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

30
docs/gotchas.md
View file

@ -32,28 +32,14 @@ Not `boot.isContainer = true`. Renamed in nixos-25.11+.
--network-veth` branch then forces a private netns — silently fatal --network-veth` branch then forces a private netns — silently fatal
for our web UIs (the bind is invisible from the host). for our web UIs (the bind is invisible from the host).
`hive-priv`'s `write_nspawn_flags` rewrites these vars every time it `hive-priv`'s `write_nspawn_flags` rewrites these vars every time it
touches the conf file, and which way it writes them depends on touches the conf file: `PRIVATE_NETWORK=1` plus a veth pair onto the
`HIVE_NETWORK_ISOLATION`: host bridge, `HOST_ADDRESS` set to the bridge gateway IP (so
`nixos-container`'s in-container init installs a default route before
- **Every real deployment today**: `hive-network.nix` sets the DHCP lease arrives), rest left for DHCP. Network isolation is the
`HIVE_NETWORK_ISOLATION=1` unconditionally whenever hyperhive is hive's only mode (`hive-network.nix` sets it up unconditionally
enabled — there's no opt-out any more (`isolateContainers` and the whenever hyperhive is enabled; `isolateContainers` and the module's own
module's own `enable` option were both removed via `enable` option were both removed via `lib.mkRemovedOptionModule` —
`lib.mkRemovedOptionModule`; "network isolation is the only mode" is "network isolation is the only mode" is the removal message itself).
the removal message itself). So `write_nspawn_flags` takes the
`isolation: Some` branch: `PRIVATE_NETWORK=1` plus a veth pair onto
the host bridge, `HOST_ADDRESS` set to the bridge gateway IP (so
`nixos-container`'s in-container init installs a default route
before the DHCP lease arrives), rest left for DHCP.
- The `None` branch — force-clear `HOST_ADDRESS` / `LOCAL_ADDRESS` /
`HOST_ADDRESS6` / `LOCAL_ADDRESS6` / `HOST_BRIDGE` and
`PRIVATE_NETWORK=0` — only fires when `HIVE_NETWORK_ISOLATION` isn't
`"1"` at all (env var unset) or the bridge subnet fails to parse
(`bridge_gateway_ip` returns `None`, logged as a warning). This isn't
a supported alternate mode, it's residual code from before isolation
was mandatory — see hyperhive#3725 for removing it (and deciding
what an unset env var / unparseable subnet should do instead of
silently degrading to non-isolated).
### systemd service PATH ≠ host PATH ### systemd service PATH ≠ host PATH