nix/host-modules/hive-forge/default.nix

@@ -535,28 +535,6 @@ in
           # all filtering; never run one in here.
           networking.firewall.enable = false;
 
-          # Teach this container the SSO name, because nothing else will.
-          #
-          # The hive's dnsmasq is authoritative for the swarm service
-          # names, but only containers whose resolv.conf points at the
-          # bridge ask it — agent containers do, by an explicit unit
-          # (`nix/agent-modules/network.nix`) written for exactly this
-          # reason. This container resolves through the host's resolvers
-          # instead, and the swarm domain has no public records, so
-          # `admin auth add-oauth` fails at discovery with "no such
-          # host" while the same name resolves fine one container over.
-          #
-          # `127.0.0.1` rather than the bridge IP: sharing the host netns
-          # means loopback IS the host, where nginx serves this vhost.
-          # TLS still validates — the CA trust bundle is bind-mounted
-          # above, and the leaf covers this name.
-          #
-          # Only when THIS host runs authelia. With a remote provider the
-          # name belongs to another machine and must resolve normally.
-          networking.hosts = lib.mkIf ssoLocal {
-            "127.0.0.1" = [ autheliaCfg.domain ];
-          };
-
           services.forgejo = {
             enable = true;
             package = cfg.package;

nix/host-modules/hive-gateway/default.nix

@@ -157,32 +157,6 @@ in
       "f /var/lib/hive-gateway/conf/gateway.htpasswd 0644 hive-core hive-core - -"
     ];
 
-    # The host asks the hive's own resolver, at the BRIDGE IP.
-    #
-    # Every container inherits a COPY of this host's `/etc/resolv.conf`
-    # at start (`nixos-containers.nix`: `cp --remove-destination`, one
-    # shot, not a bind-mount) — so whatever address is written here is
-    # the address every container will try, in its own netns.
-    #
-    # 🚨 That is why this is the bridge IP and not `127.0.0.1`, and the
-    # distinction is load-bearing rather than stylistic:
-    #
-    #   value       host   host-netns containers   bridged containers
-    #   127.0.0.1    ok            ok               THEIR OWN loopback
-    #   bridge IP    ok            ok                      ok
-    #
-    # dnsmasq binds both `lo` and the bridge (./dnsmasq.nix), so the
-    # bridge IP is reachable from the host too — it is the only value
-    # correct on both sides of a netns boundary. `resolveLocalQueries`
-    # publishes loopback by default, hence both overrides here; the
-    # flag stays on for its `resolv-file` plumbing, which is what keeps
-    # dnsmasq's own upstreams out of the file we are pointing at it.
-    #
-    # Cost, stated because it is real: the host's DNS now depends on
-    # dnsmasq being up. Every container already did.
-    networking.nameservers = lib.mkForce [ networkCfg.bridgeIp ];
-    networking.resolvconf.useLocalResolver = lib.mkForce false;
-
     # ACME (Let's Encrypt) integration. nginx vhosts set
     # `enableACME = true` via the vhost builder; this provides the
     # shared ACME config (acceptTerms + email).

nix/host-modules/hive-gateway/dnsmasq.nix

@@ -16,19 +16,10 @@
 }:
 {
   enable = true;
-  # ON for its *plumbing*, not for the address it publishes.
-  #
-  # This flag does two separable things upstream. The one that matters
-  # here: it points dnsmasq's own upstream servers at a SEPARATE file
-  # (`resolv-file = /etc/dnsmasq-resolv.conf`, kept current by
-  # resolvconf). Without that, dnsmasq reads `/etc/resolv.conf` for its
-  # upstreams — so the moment the host's resolver is pointed at dnsmasq,
-  # every non-hive query goes in a circle.
-  #
-  # The other thing it does is publish `127.0.0.1` as the host's
-  # nameserver, which is the wrong address for this hive: see the
-  # `nameservers` override in ./default.nix, where the reason lives.
-  resolveLocalQueries = true;
+  # Don't substitute the container's /etc/resolv.conf — the gateway
+  # uses the host's resolver for its own outbound traffic; dnsmasq is
+  # purely for incoming queries from agent containers.
+  resolveLocalQueries = false;
   settings = {
     # Bind only on the bridge interface (and lo for health-checks).
     # Outside hosts can't even see the listener.