d8e26a17bb
`services.hyperhive.gateway.enable`, `gateway.dns.enable` and `network.enable` replace the `hyperhive.enable` gate on all three. Each defaults to false; the modules that need one assert it with `mkDefault true` from inside the guard their own deployment already carries, and `swarm-required-services.nix` — the module that owns what the swarm-services toggle implies — asserts all three explicitly. hive-c0re asserts all three unconditionally, so an ordinary hive keeps getting them with no opt-in: it is the host's only knowledge that agent containers exist. The resolver moves to its own `hive-gateway/dns.nix` so it can be gated without reindenting the nginx half of the module. Reinstates `network.enable`, dropping its `mkRemovedOptionModule` shim. A config still carrying `network.enable = false` from before the removal now switches the bridge off instead of failing eval. Also deletes a duplicate `centralToggleOff` fixture in nix/module-eval.nix. Two sibling slices added it independently (c5f60fd5,ce3b3d94); the merge was textually clean and left `main` failing to evaluate at all, so this file could not be gated without removing one.
63 lines
2.5 KiB
Nix
63 lines
2.5 KiB
Nix
# The hive's dnsmasq resolver. Split out of ./default.nix because it has
|
|
# its own enable: a host can need hive names to resolve without serving a
|
|
# single vhost. Option declared in ./options.nix, config rendered by
|
|
# ./dnsmasq.nix.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.hyperhive.gateway;
|
|
networkCfg = config.services.hyperhive.network;
|
|
hyperhiveDomain = config.services.hyperhive.domain;
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.dns.enable {
|
|
# dnsmasq is a host service alongside nginx, so it reads the host's
|
|
# /etc/resolv.conf directly and picks up network changes as they
|
|
# happen — no copy to keep in sync.
|
|
services.dnsmasq = import ./dnsmasq.nix {
|
|
inherit
|
|
lib
|
|
cfg
|
|
networkCfg
|
|
hyperhiveDomain
|
|
;
|
|
};
|
|
|
|
# dnsmasq binds the bridge interface and answers with the bridge
|
|
# address, so the resolver is itself a consumer one layer down.
|
|
services.hyperhive.network.enable = lib.mkDefault true;
|
|
|
|
# A name that stops resolving presents as every client timing out at
|
|
# once, so this unit's journal is worth reading swarm-wide.
|
|
services.hyperhive.swarm.otel.journaldUnits = [ "dnsmasq" ];
|
|
|
|
# The host asks the hive's own resolver, at the BRIDGE IP.
|
|
#
|
|
# Every container inherits a COPY of this host's `/etc/resolv.conf`
|
|
# at start (`nixos-containers.nix`: `cp --remove-destination`, one
|
|
# shot, not a bind-mount) — so whatever address is written here is
|
|
# the address every container will try, in its own netns.
|
|
#
|
|
# 🚨 That is why this is the bridge IP and not `127.0.0.1`, and the
|
|
# distinction is load-bearing rather than stylistic:
|
|
#
|
|
# value host host-netns containers bridged containers
|
|
# 127.0.0.1 ok ok THEIR OWN loopback
|
|
# bridge IP ok ok ok
|
|
#
|
|
# dnsmasq binds both `lo` and the bridge (./dnsmasq.nix), so the
|
|
# bridge IP is reachable from the host too — it is the only value
|
|
# correct on both sides of a netns boundary. `resolveLocalQueries`
|
|
# publishes loopback by default, hence both overrides here; the
|
|
# flag stays on for its `resolv-file` plumbing, which is what keeps
|
|
# dnsmasq's own upstreams out of the file we are pointing at it.
|
|
#
|
|
# Cost, stated because it is real: the host's DNS now depends on
|
|
# dnsmasq being up. Every container already did.
|
|
networking.nameservers = lib.mkForce [ networkCfg.bridgeIp ];
|
|
networking.resolvconf.useLocalResolver = lib.mkForce false;
|
|
};
|
|
}
|