vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(network): co-locate exposeHostPorts firewall opening with the proxies (argus review on #1972)

Browse source
This commit is contained in:
damocles 2026-06-24 19:28:29 +02:00
commit fe68bfbadc
1 changed files with 15 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/modules/hive-network.nix
View file

@ -229,12 +229,12 @@ in
# Allow isolated agents to reach the gateway (nginx on the host, shared # Allow isolated agents to reach the gateway (nginx on the host, shared
# netns). Port 80 covers `http://forge.<domain>`, per-agent UI proxies, # netns). Port 80 covers `http://forge.<domain>`, per-agent UI proxies,
# and any other HTTP services the gateway fronts. Port 443 for HTTPS. # and any other HTTP services the gateway fronts. Port 443 for HTTPS.
# `exposeHostPorts` adds any operator-declared host-loopback proxies. # (`exposeHostPorts` opens its own ports in its dedicated block below,
# co-located with the proxies so the firewall hole + listener can't drift.)
networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts = [ networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts = [
80 80
443 443
] ];
++ cfg.exposeHostPorts;
# Tells hive-c0re to pass PRIVATE_NETWORK + bridge settings to each # Tells hive-c0re to pass PRIVATE_NETWORK + bridge settings to each
# container. HIVE_NETWORK_SUBNET is host-bridge IP/prefix, not canonical # container. HIVE_NETWORK_SUBNET is host-bridge IP/prefix, not canonical
@ -253,6 +253,14 @@ in
# DROP rule above — agents connect to the bridge IP, and the host's own # DROP rule above — agents connect to the bridge IP, and the host's own
# proxy process is what dials 127.0.0.1. See docs/network.md. # proxy process is what dials 127.0.0.1. See docs/network.md.
(lib.mkIf (config.services.hyperhive.enable && cfg.exposeHostPorts != [ ]) { (lib.mkIf (config.services.hyperhive.enable && cfg.exposeHostPorts != [ ]) {
# Open the proxied ports on the bridge firewall HERE — same block + same
# gate as the proxies — so the firewall hole and the listener are always
# created together (never one without the other). Merges with the
# [ 80 443 ] gateway ports defined above. Independent of the deprecated
# isolateContainers toggle: isolation is unconditional, so this works
# under network isolation (the only mode).
networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts = cfg.exposeHostPorts;
systemd.sockets = lib.listToAttrs ( systemd.sockets = lib.listToAttrs (
map ( map (
p: p:
@ -274,8 +282,10 @@ in
serviceConfig = { serviceConfig = {
ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd 127.0.0.1:${toString p}"; ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd 127.0.0.1:${toString p}";
SyslogIdentifier = "hive-hostport-${toString p}"; SyslogIdentifier = "hive-hostport-${toString p}";
# Pure userspace TCP proxy: no filesystem, no privileges, no extra # Hardened userspace TCP relay. AF_INET/AF_INET6 for the upstream
# address families beyond inet/unix. DynamicUser keeps it unprivileged. # loopback dial; AF_UNIX only for systemd-socket-proxyd's sd_notify
# (the listen fd itself is inherited via LISTEN_FDS, so the relay
# never socket()s its own listener). DynamicUser keeps it unprivileged.
DynamicUser = true; DynamicUser = true;
NoNewPrivileges = true; NoNewPrivileges = true;
ProtectSystem = "strict"; ProtectSystem = "strict";