kyle/imladris
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

straylight: add isolated mcp-br0 bridge for unikernel VMs

Browse Source 
Host-only 10.99.0.0/24 bridge with no uplink/NAT; firewall drops VM
traffic leaving the bridge so unikernel VMs can reach only the gateway
(mc-proxy). Implements Phase 2 mandatory-mediation networking.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Kyle Isom
2026-06-11 01:04:57 -07:00
parent 5ffe206f72
commit 92b39fc031
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
hw/straylight/default.nix
View File

@@ -22,6 +22,26 @@
# Let the mcp user reach /dev/kvm directly as well. # Let the mcp user reach /dev/kvm directly as well.
users.users.mcp.extraGroups = [ "kvm" ]; users.users.mcp.extraGroups = [ "kvm" ];
# Isolated host-only bridge for unikernel VMs (Phase 2). Each unikernel
# gets a TAP on this bridge and a 10.99.0.0/24 static IP. The bridge has
# NO uplink and NO NAT, and the firewall drops any VM traffic leaving the
# bridge, so a VM can reach only the host gateway (10.99.0.1) -- mediation
# is enforced by network topology, not convention.
networking.bridges.mcp-br0.interfaces = [ ];
networking.interfaces.mcp-br0.ipv4.addresses = [
{ address = "10.99.0.1"; prefixLength = 24; }
];
# The host accepts traffic from VMs (so mc-proxy on the gateway can serve
# them); the FORWARD drop prevents VMs from routing anywhere off-bridge.
networking.firewall.trustedInterfaces = [ "mcp-br0" ];
networking.firewall.extraCommands = ''
iptables -D FORWARD -i mcp-br0 ! -o mcp-br0 -j DROP 2>/dev/null || true
iptables -A FORWARD -i mcp-br0 ! -o mcp-br0 -j DROP
'';
networking.firewall.extraStopCommands = ''
iptables -D FORWARD -i mcp-br0 ! -o mcp-br0 -j DROP 2>/dev/null || true
'';
# Allow rootless containers (podman) to bind low ports (53 for MCNS, # Allow rootless containers (podman) to bind low ports (53 for MCNS,
# 443/8443/9443 for mc-proxy) as straylight takes over the core role. # 443/8443/9443 for mc-proxy) as straylight takes over the core role.
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53; boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53;