nix flake update

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "crane": {
       "locked": {
-        "lastModified": 1779130139,
-        "narHash": "sha256-BLrtr42azquO7MdGFU5a7KiMl3YpFlTeIXqy1fT5GlQ=",
+        "lastModified": 1783203018,
+        "narHash": "sha256-G6R9IT/xwFuu+CYBWDUAok6AdC4ERC4ZfPPFtEpxnZE=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "edb38893982a3338972bb4a2ec7ce7c29ba10fd9",
+        "rev": "80db5bdc391be8a1794f6d8a2d56e3a84ebcede2",
         "type": "github"
       },
       "original": {
@@ -17,11 +17,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1782847225,
-        "narHash": "sha256-JC9PjqKYG9ve5U8aDOLQipp3+KLANBHUvGdLZlxzdKI=",
+        "lastModified": 1783856661,
+        "narHash": "sha256-ZGP04e+Q6WyQJGA9ZvI5CL6+heGQldbAG9U1T9NGvmU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "95ca1e203c0750115fd4a6f17d5a245dfe6b1edd",
+        "rev": "569d578509928497eddc3fdbf94a799027050be4",
         "type": "github"
       },
       "original": {
@@ -45,11 +45,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {

nix/modules/hive-gateway.nix

@@ -481,6 +481,14 @@ in
       # port-forward dance, and the firewall config below is the only
       # layer that matters.
       privateNetwork = false;
+      # dnsmasq refuses to start once a dhcp-range is configured unless it
+      # holds CAP_NET_ADMIN (DNS-only mode doesn't need it). Private-network
+      # containers retain NET_ADMIN implicitly, but this container shares the
+      # host netns (above), so nspawn's default bounding set drops it — grant
+      # it explicitly. Note this is NET_ADMIN over the *host* netns; the
+      # gateway container is trusted infra (it already terminates TLS and
+      # fronts every vhost), so no new trust boundary is crossed.
+      additionalCapabilities = [ "CAP_NET_ADMIN" ];
       # Bind-mount the per-agent socket dir so nginx inside the gateway
       # container can `connect(2)` to the UDS upstreams.
       # Read-only (we just connect; harness writes the socket inside