59 lines
2.5 KiB
Nix
59 lines
2.5 KiB
Nix
# Hive-internal DNS resolver + DHCP, co-located in the gateway
|
|
# container — single front-door for both DNS and HTTP, saves a
|
|
# sibling container. Listens on the bridge interface from
|
|
# `services.hyperhive.network`; authoritative for the hive domain +
|
|
# sub-domains, forwards everything else upstream. Returns the
|
|
# `services.dnsmasq` value for the container config (see
|
|
# ./default.nix); the DHCP pool bounds are computed by hive-network.
|
|
{
|
|
lib,
|
|
networkCfg,
|
|
forgeCfg,
|
|
matrixCfg,
|
|
hyperhiveDomain,
|
|
}:
|
|
{
|
|
enable = true;
|
|
# Don't substitute the container's /etc/resolv.conf — the gateway
|
|
# uses the host's resolver for its own outbound traffic; dnsmasq is
|
|
# purely for incoming queries from agent containers.
|
|
resolveLocalQueries = false;
|
|
settings = {
|
|
# Bind only on the bridge interface (and lo for health-checks).
|
|
# Outside hosts can't even see the listener.
|
|
interface = [
|
|
networkCfg.bridgeName
|
|
"lo"
|
|
];
|
|
bind-interfaces = true;
|
|
port = 53;
|
|
# Don't read /etc/resolv.conf — we control upstream explicitly to
|
|
# dodge dependency on the gateway container's own resolver state.
|
|
no-resolv = true;
|
|
server = networkCfg.upstreamDns;
|
|
# Hive authoritative records — answer queries for the hive domain
|
|
# + its sub-domains with the bridge IP, where nginx is reachable
|
|
# from every container netns.
|
|
#
|
|
# The forge / matrix entries are redundant in the common case
|
|
# where `forge.domain` / `matrix.gatewayHost` are sub-domains of
|
|
# `hyperhive.domain` — dnsmasq's `/<domain>/` rule already matches
|
|
# sub-domains. Kept explicit because operators can override either
|
|
# to a cross-domain hostname (e.g. `forge.domain =
|
|
# "git.example.com"`); listing them explicitly keeps that case
|
|
# routed without needing an extra config block.
|
|
address = [
|
|
"/${hyperhiveDomain}/${networkCfg.bridgeIp}"
|
|
]
|
|
++ lib.optional ((forgeCfg.behindGateway or false)) "/${forgeCfg.domain}/${networkCfg.bridgeIp}"
|
|
++ lib.optional (
|
|
matrixCfg.enable && matrixCfg.gatewayHost != null
|
|
) "/${matrixCfg.gatewayHost}/${networkCfg.bridgeIp}";
|
|
# DHCP pool covering all usable host addresses on the bridge
|
|
# subnet — bounds computed by hive-network.nix from
|
|
# bridgeIp/bridgePrefixLength. All containers (agents and service
|
|
# containers such as hive-ci) receive their IPs dynamically.
|
|
dhcp-range = "${networkCfg.dhcpRangeStart},${networkCfg.dhcpRangeEnd},1h";
|
|
dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
|
|
};
|
|
}
|