vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

refactor(3202): all-local asserts the host's own /etc/hosts entries

Browse source 
Clause 2 of #3202, reading 1 (mara: "the all local stuff and swarm
services auto conf belong in those mods, not spread all over").

`gateway.localHostsEntry` is the gateway's only local-deployment knob —
`openFirewall` is about EXTERNAL exposure, `tls.acme` needs a public DNS
name, `hsts` is a hardening choice. It is now asserted by the mode in
local-defaults.nix, beside the three swarm toggles, instead of being the
one all-local implication an operator still had to know about.

`mkDefault`, so "all local except this" still needs no new option.

⚠️ The non-obvious half: this does NOT change what CONTAINERS resolve.
dnsmasq sets `no-hosts = true` unconditionally, so agents keep getting
the bridge IP from the authoritative `address=` rules rather than the
host's 127.0.0.1 — which would point every agent at its own netns. That
guard already existing is what makes this safe to default on; without it
this one line would break every agent's access to the forge.
This commit is contained in:
atlas 2026-08-13 16:25:56 +02:00 • committed by mara
commit f80facbbe0
2 changed files with 29 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nix/host-modules/local-defaults.nix
View file

@ -29,11 +29,15 @@ in
example = true;
description = ''
Run the whole swarm on this host. Turning this on asserts the
swarm-level toggles that an all-on-one-box deployment implies:
the swarm's shared services
toggles that an all-on-one-box deployment implies: the swarm's
shared services
(`services.hyperhive.swarm.enableRequiredServices`), the swarm
CA (`services.hyperhive.swarm.ca.autoConfigure`), and the swarm
controller (`services.hyperhive.swarm.controller.enable`).
CA (`services.hyperhive.swarm.ca.autoConfigure`), the swarm
controller (`services.hyperhive.swarm.controller.enable`), and the
host's `/etc/hosts` entries for the names this hive serves
(`services.hyperhive.gateway.localHostsEntry`) — with no real DNS
for those names, the operator is browsing them from the same box
that answers for them.
**Off by default, and that is the load-bearing part.** A swarm's
services and its hives can live on different hosts, and a host has
@ -52,6 +56,21 @@ in
# own `default` (1500) and loses to any explicit definition, which is
# exactly the precedence a deployment mode wants: it fills in for an
# operator who hasn't spoken, and never argues with one who has.
# The gateway's own all-local bit. `localHostsEntry` maps every name
# this hive answers for to 127.0.0.1 in the HOST's /etc/hosts, which is
# exactly what "this box is the whole deployment" implies: there is no
# real DNS for these names, and the operator is browsing them from the
# same machine that serves them.
#
# ⚠️ It does NOT affect what containers resolve. dnsmasq sets
# `no-hosts = true` unconditionally (see hive-gateway/dnsmasq.nix), so
# agents keep getting the bridge IP from the authoritative `address=`
# rules rather than the host's 127.0.0.1 — an entry that would point
# every agent at its own netns. That guard already existing is what
# makes turning this on by default safe; without it this line would
# break every agent's access to the forge.
config.services.hyperhive.gateway.localHostsEntry = lib.mkDefault cfg.enableAllLocalDefaults;
config.services.hyperhive.swarm = {
enableRequiredServices = lib.mkDefault cfg.enableAllLocalDefaults;
ca.autoConfigure = lib.mkDefault cfg.enableAllLocalDefaults;