From db2eb1318fffa90e9f2d81944c8236860acf32fc Mon Sep 17 00:00:00 2001 From: Jo Date: Tue, 11 Aug 2026 03:45:26 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7=20Add=20more=20privilege=20to=20ot?= =?UTF-8?q?br=20config?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../nixos/services/home-assistant/default.nix | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/modules/nixos/services/home-assistant/default.nix b/modules/nixos/services/home-assistant/default.nix index 30e21cf..7f31e36 100644 --- a/modules/nixos/services/home-assistant/default.nix +++ b/modules/nixos/services/home-assistant/default.nix @@ -227,15 +227,26 @@ in virtualisation.oci-containers.containers.otbr = { image = "ghcr.io/ownbee/hass-otbr-docker:${cfg.otbr.version}"; + # Upstream is emphatic that the border router needs full privileges and + # the host network, s6-overlay bails out early otherwise. + privileged = true; extraOptions = [ "--network=host" ]; capabilities.NET_ADMIN = true; - capabilities.NET_RAW = true; + capabilities.SYS_ADMIN = true; + + devices = [ + "${otbrDevice}:${otbrDevice}" + + # otbr-agent puts the Thread mesh behind a TUN interface. + "/dev/net/tun:/dev/net/tun" + ]; - devices = [ "${otbrDevice}:/dev/ttyACM0" ]; - volumes = [ "${cfg.path}/otbr:/var/lib/thread" ]; + # The entrypoint symlinks /var/lib/thread at /data/thread, so mounting + # over /var/lib/thread would stop it from ever being created. + volumes = [ "${cfg.path}/otbr:/data/thread" ]; environment = { - "DEVICE" = "/dev/ttyACM0"; + "DEVICE" = otbrDevice; "BAUDRATE" = toString cfg.otbr.baudrate; "FLOW_CONTROL" = if cfg.otbr.flowControl then "1" else "0"; "BACKBONE_IF" = cfg.otbr.backboneInterface; -- 2.51.2