vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs/gotchas: drop the env-var/removed-option framing, just state the always-isolated behavior

Browse source
This commit is contained in:
damocles 2026-08-29 12:13:54 +02:00 • committed by mara
commit f1c5d49289
1 changed files with 6 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/gotchas.md
View file

@ -30,16 +30,12 @@ Not `boot.isContainer = true`. Renamed in nixos-25.11+.
…in the `.conf`. The start script's `if HOST_ADDRESS set →
--network-veth` branch then forces a private netns — silently fatal
for our web UIs (the bind is invisible from the host).
`hive-priv`'s `write_nspawn_flags` rewrites these vars every time it
touches the conf file: `PRIVATE_NETWORK=1` plus a veth pair onto the
host bridge, `HOST_ADDRESS` set to the bridge gateway IP (so
`nixos-container`'s in-container init installs a default route before
the DHCP lease arrives), rest left for DHCP. Network isolation is the
hive's only mode (`hive-network.nix` sets it up unconditionally
whenever hyperhive is enabled; `isolateContainers` and the module's own
`enable` option were both removed via `lib.mkRemovedOptionModule` —
"network isolation is the only mode" is the removal message itself).
for our web UIs (the bind is invisible from the host). Every agent
container runs isolated: `hive-priv`'s `write_nspawn_flags` writes
`PRIVATE_NETWORK=1` plus a veth pair onto the host bridge, `HOST_ADDRESS`
set to the bridge gateway IP (so `nixos-container`'s in-container init
installs a default route before the DHCP lease arrives), rest left for
DHCP.
### systemd service PATH ≠ host PATH