From 3a3f318779eb801d9d905c320934b84fab5c5313 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Mon, 13 Jul 2026 13:57:37 +0200
Subject: [PATCH 1/2] =?UTF-8?q?fix(#2363):=20grant=20hive-gateway=20CAP=5F?=
 =?UTF-8?q?NET=5FADMIN=20=E2=80=94=20dnsmasq=20DHCP=20mode=20requires=20it?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 nix/modules/hive-gateway.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nix/modules/hive-gateway.nix b/nix/modules/hive-gateway.nix
index b3f13f13..71dcb87b 100644
--- a/nix/modules/hive-gateway.nix
+++ b/nix/modules/hive-gateway.nix
@@ -481,6 +481,14 @@ in
       # port-forward dance, and the firewall config below is the only
       # layer that matters.
       privateNetwork = false;
+      # dnsmasq refuses to start once a dhcp-range is configured unless it
+      # holds CAP_NET_ADMIN (DNS-only mode doesn't need it). Private-network
+      # containers retain NET_ADMIN implicitly, but this container shares the
+      # host netns (above), so nspawn's default bounding set drops it — grant
+      # it explicitly. Note this is NET_ADMIN over the *host* netns; the
+      # gateway container is trusted infra (it already terminates TLS and
+      # fronts every vhost), so no new trust boundary is crossed.
+      additionalCapabilities = [ "CAP_NET_ADMIN" ];
       # Bind-mount the per-agent socket dir so nginx inside the gateway
       # container can `connect(2)` to the UDS upstreams.
       # Read-only (we just connect; harness writes the socket inside

From 2cdd5f334e66e2b727442b3737bbdcb5d3f91595 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Mon, 13 Jul 2026 13:58:53 +0200
Subject: [PATCH 2/2] nix flake update

---
 flake.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/flake.lock b/flake.lock
index eed4737a..822c3fab 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1779130139,
-        "narHash": "sha256-BLrtr42azquO7MdGFU5a7KiMl3YpFlTeIXqy1fT5GlQ=",
+        "lastModified": 1783203018,
+        "narHash": "sha256-G6R9IT/xwFuu+CYBWDUAok6AdC4ERC4ZfPPFtEpxnZE=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "edb38893982a3338972bb4a2ec7ce7c29ba10fd9",
+        "rev": "80db5bdc391be8a1794f6d8a2d56e3a84ebcede2",
         "type": "github"
       },
       "original": {
@@ -17,11 +17,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782847225,
-        "narHash": "sha256-JC9PjqKYG9ve5U8aDOLQipp3+KLANBHUvGdLZlxzdKI=",
+        "lastModified": 1783856661,
+        "narHash": "sha256-ZGP04e+Q6WyQJGA9ZvI5CL6+heGQldbAG9U1T9NGvmU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "95ca1e203c0750115fd4a6f17d5a245dfe6b1edd",
+        "rev": "569d578509928497eddc3fdbf94a799027050be4",
         "type": "github"
       },
       "original": {
@@ -45,11 +45,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {