Add toggle for host networking (#390)

<!-- Please make sure there is an issue that this PR is correlated to. -->

## Changes
Fixes HUB-300
<!-- If there are frontend changes, please include screenshots. -->

.github/actions/pre-init/action.yaml

@@ -67,8 +67,7 @@ runs:
         EOF
 
         cat << 'EOF' > namespaces/ci.toml
-        [rivet]
-        test = {}
+        [rivet.test]
 
         # We set the public IP to localhost because we are running inside of a github action, therefore
         # it is not reachable from the public.

lib/bolt/config/src/ns.rs

@@ -561,6 +561,8 @@ pub struct Rivet {
 	pub cdn: Cdn,
 	#[serde(default)]
 	pub billing: Option<RivetBilling>,
+	#[serde(default)]
+	pub matchmaker: Option<RivetMatchmaker>,
 }
 
 #[derive(Serialize, Deserialize, Clone, Debug, Default)]
@@ -571,6 +573,13 @@ pub struct Telemetry {
 	pub disable: bool,
 }
 
+#[derive(Serialize, Deserialize, Clone, Debug, Default)]
+#[serde(deny_unknown_fields)]
+pub struct RivetMatchmaker {
+	#[serde(default)]
+	pub host_networking: bool,
+}
+
 #[derive(Serialize, Deserialize, Clone, Debug)]
 #[serde(deny_unknown_fields)]
 pub enum RivetAccess {

lib/bolt/core/src/context/project.rs

@@ -222,6 +222,18 @@ impl ProjectContextData {
 				);
 			}
 		}
+
+		if self.ns().rivet.test.is_some()
+			&& !self.ns().pools.is_empty()
+			&& !self
+				.ns()
+				.rivet
+				.matchmaker
+				.as_ref()
+				.map_or(false, |mm| mm.host_networking)
+		{
+			panic!("must have host networking enabled if tests + pools are enabled (rivet.matchmaker.host_networking = true)");
+		}
 	}
 
 	// Traverses from FS root to CWD, returns first directory with Bolt.toml

lib/bolt/core/src/context/service.rs

@@ -776,6 +776,12 @@ impl ServiceContextData {
 			env.push(("RIVET_ACCESS_TOKEN_LOGIN".into(), "1".into()));
 		}
 
+		if let Some(mm) = &project_ctx.ns().rivet.matchmaker {
+			if mm.host_networking {
+				env.push(("RIVET_HOST_NETWORKING".into(), "1".into()));
+			}
+		}
+
 		// Domains
 		if let Some(x) = project_ctx.domain_main() {
 			env.push(("RIVET_DOMAIN_MAIN".into(), x));

svc/pkg/game/ops/version-validate/src/lib.rs

@@ -718,14 +718,17 @@ async fn handle(
 					}
 				}
 
+				let network_mode = unwrap!(LobbyRuntimeNetworkMode::from_i32(
+					docker_config.network_mode
+				));
+				let host_networking_enabled =
+					std::env::var("RIVET_HOST_NETWORKING").map_or(false, |v| v == "1");
 				// Validate ports
+				if host_networking_enabled || !matches!(network_mode, LobbyRuntimeNetworkMode::Host)
 				{
 					let mut unique_port_labels = HashSet::<String>::new();
 					let mut unique_ports = HashSet::<(u32, i32)>::new();
 					let mut ranges = Vec::<PortRange>::new();
-					let network_mode = unwrap!(LobbyRuntimeNetworkMode::from_i32(
-						docker_config.network_mode
-					));
 
 					if docker_config.ports.len() > 16 {
 						errors.push(util::err_path![
@@ -955,6 +958,14 @@ async fn handle(
 							}
 						}
 					}
+				} else {
+					errors.push(util::err_path![
+						"config",
+						"matchmaker",
+						"game-modes",
+						lobby_group_label,
+						"host-networking-disabled",
+					]);
 				}
 			} else {
 				errors.push(util::err_path![