vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

docs(3191): the gateway's comments describe a host service, not a container

Browse source 
Prose-only sweep of every remaining claim that nginx or dnsmasq lives
in a container: the port comment (root in a container -> root on the
host), upstreamHost's netns rationale, the ACME state dir, the store
path reachability note, the vhost tree header, dnsmasq's resolv.conf
paragraph (there is no copy and no path unit watching it any more),
the two hive-network bridge comments, and swarm-controller's socket
access-control note, which described a bind-mount that no longer
exists.

No behaviour change; all of it was describing a mechanism that was
deleted.
This commit is contained in:
atlas 2026-08-12 12:20:28 +02:00
commit f85724a638
7 changed files with 54 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/hive-gateway/dnsmasq.nix
View file

@ -1,10 +1,10 @@
# Hive-internal DNS resolver + DHCP, co-located in the gateway
# container — single front-door for both DNS and HTTP, saves a
# sibling container. Listens on the bridge interface from
# Hive-internal DNS resolver + DHCP, running on the host alongside the
# gateway's nginx — single front-door for both DNS and HTTP, and no
# container of its own. Listens on the bridge interface from
# `services.hyperhive.network`; authoritative for the hive domain +
# sub-domains, forwards everything else upstream. Returns the
# `services.dnsmasq` value for the container config (see
# ./default.nix); the DHCP pool bounds are computed by hive-network.
# `services.dnsmasq` value (see ./default.nix); the DHCP pool bounds
# are computed by hive-network.
{
lib,
networkCfg,
@ -68,14 +68,13 @@
dhcp-range = "${networkCfg.dhcpRangeStart},${networkCfg.dhcpRangeEnd},1h";
dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
# No explicit upstream: non-hive queries follow dnsmasq's
# resolv.conf default — the gateway container's `/etc/resolv.conf`,
# which nixos-container copies from the host at every start, so the
# hive always uses the host's resolvers. resolvconf is disabled in
# the container (see ./default.nix) so nothing regenerates that
# copy; the host-side `hive-gateway-resolv` path unit (also in
# ./default.nix) pushes in a fresh copy and reloads dnsmasq whenever
# the host's resolvers change, so the copy can't go stale under a
# network switch. Deliberately no fallback `server=`: dnsmasq queries
# resolv.conf default — the host's own `/etc/resolv.conf`, so the
# hive always uses the host's resolvers and follows them live. This
# used to be a *copy* nixos-container made at container start, kept
# fresh by a host-side path unit that pushed in a new one and
# reloaded dnsmasq; running on the host deleted both the copy and
# the machinery that watched it. Deliberately no fallback
# `server=`: dnsmasq queries
# all known upstreams in parallel, so a hardcoded public resolver
# would take a share of *normal* traffic, not just fill in when the
# host file is empty.