didericis
ce3fad9320
The default TAP-pool base was 100.64.0.0/10 (RFC-6598 CGNAT) — chosen to dodge RFC-1918, but that's exactly the range Tailscale assigns node addresses from, so on a Tailscale host it's the worst pick. Move the default to 10.243.0.0/16, an obscure RFC-1918 block that steers clear of docker/libvirt/k8s/LAN and Tailscale. No default is collision-proof, so add netpool.overlapping_routes(): it parses `ip -json route show table all` and flags any route intersecting the pool range (excluding our own bbfc* TAPs and the default route). The launch preflight warns on overlap; `backend status` reports it. Distribute the NixOS host setup as a flake module instead of a copy-pasted blob: nix/firecracker-netpool.nix computes the taps / nft table from typed options (poolSize, ipBase, ifacePrefix, owner) with a /31-alignment assertion, and flake.nix exposes it as nixosModules.firecracker-netpool. Defaults mirror the backend constants; writeEnvFile emits the matching BOT_BOTTLE_FC_* so the host pool and the launcher can't drift. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
19 lines
797 B
Nix
19 lines
797 B
Nix
{
|
|
description = "bot-bottle — sandboxed runtime for AI coding agents";
|
|
|
|
outputs = { self, ... }: {
|
|
# Declarative host setup for the Firecracker backend's network pool.
|
|
# Consume from a flake-based NixOS config:
|
|
#
|
|
# inputs.bot-bottle.url = "git+ssh://<your-bot-bottle-remote>"; # or path:/…
|
|
# # then, in your host module:
|
|
# imports = [ inputs.bot-bottle.nixosModules.firecracker-netpool ];
|
|
# services.bot-bottle-firecracker = { enable = true; owner = "you"; };
|
|
#
|
|
# The module is plain (no nixpkgs pin), so channel users can import
|
|
# ./nix/firecracker-netpool.nix directly without the flake.
|
|
nixosModules.firecracker-netpool = import ./nix/firecracker-netpool.nix;
|
|
nixosModules.default = self.nixosModules.firecracker-netpool;
|
|
};
|
|
}
|