mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

wait for grafana's socket and read the forge's user list whole in the mint

Browse source
This commit is contained in:
atlas 2026-11-02 00:22:25 +01:00
commit 279428a66f
1 changed files with 95 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

26
nix/host-modules/hive-forge/default.nix
View file

@ -71,6 +71,12 @@ let
baoCfg = config.services.hyperhive.swarm.bao;
storeRetry = import ../lib/store-retry.nix { };
retryInJob = import ../lib/retry-in-job.nix { };
# How long the controller-account mint re-checks that the forge lists the
# account it just ensured. The mint is in the forge container's boot wait,
# whose `container@` limit is a minute.
accountRecheckSec = 15;
storeRefreshTimer = import ../lib/store-refresh-timer.nix { };
atomicWriteSecret = import ../lib/atomic-write-secret.nix { };
refreshConsumer = import ../lib/refresh-consumer.nix { };
@ -1052,14 +1058,28 @@ in
# an already-provisioned non-admin account to work around
# that (every hive from before this fix has one) — she
# promotes those by hand instead.
if ! forgejo admin user list | grep -qE "[[:space:]]${swarmControllerForgeUser}[[:space:]]"; then
${retryInJob}
# The list is read whole before `grep` sees it: `grep -q` leaves
# at its first match, and under `pipefail` forgejo's write to the
# closed pipe would fail the pipeline for an account that is
# listed.
account_listed() {
local list
list="$(forgejo admin user list "$@")" || return 1
grep -qE "[[:space:]]${swarmControllerForgeUser}[[:space:]]" <<<"$list"
}
if ! account_listed; then
forgejo admin user create \
--username ${lib.escapeShellArg swarmControllerForgeUser} \
--email ${lib.escapeShellArg "${swarmControllerForgeUser}@hyperhive.local"} \
--admin --random-password --must-change-password=false
echo "created forge account ${swarmControllerForgeUser}"
fi
if ! forgejo admin user list | grep -qE "[[:space:]]${swarmControllerForgeUser}[[:space:]]"; then
# This unit is part of the container's boot wait, so the re-check
# stays well under its start limit (`accountRecheckSec`).
if ! retry_in_job ${toString accountRecheckSec} account_listed; then
echo "forge account ${swarmControllerForgeUser} absent after creation" >&2
exit 1
fi
@ -1099,7 +1119,7 @@ in
# The revocation below goes through the forge's admin API,
# which refuses a token of an account that is not a site
# admin; each retry would then leave one more token live.
if ! forgejo admin user list --admin | grep -qE "[[:space:]]${swarmControllerForgeUser}[[:space:]]"; then
if ! account_listed --admin; then
echo "forge account ${swarmControllerForgeUser} is not a site admin; promote it by hand. No token minted." >&2
exit 1
fi