mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

wait for grafana's socket and read the forge's user list whole in the mint

Browse source
This commit is contained in:
atlas 2026-11-02 00:22:25 +01:00
commit 279428a66f
2 changed files with 95 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nix/module-eval/forge-placement.nix
View file

@ -356,7 +356,7 @@ let
order = l: lib.length l < 2 || (at (lib.elemAt l 0) < at (lib.elemAt l 1) && order (lib.tail l));
steps = [
"if [ -s \"$name_path\" ]; then"
"forgejo admin user list --admin"
"account_listed --admin"
"bao login -method=cert"
"forgejo admin user generate-access-token"
"bao kv put"
@ -391,6 +391,31 @@ let
))
&& lib.elem "forgejo-swarm-controller-account.service" c.swarm-bridge-dns.before;
}
{
# The mint is in the forge container's boot wait (a oneshot in
# `multi-user.target`), so what it waits for inside its start stays under
# `container@`'s start limit. The account check reads the list whole: a
# `grep -q` on a pipe under `pipefail` fails an account that is listed.
name = "the forge's mint re-checks the account for a bounded time, under the container's start limit, and reads the list without a pipe";
ok =
let
u = mint allLocal;
s = u.script;
parts = lib.splitString "if ! retry_in_job " s;
budget = lib.toInt (lib.head (lib.splitString " " (lib.elemAt parts 1)));
in
lib.length parts == 2
&& lib.hasInfix "retry_in_job() {" s
&& lib.hasInfix "${toString budget} account_listed; then" s
&& budget > 0
&& budget <= 20
&& allLocal.containers.hive-forge.timeoutStartSec == "1min"
&& lib.elem "multi-user.target" u.wantedBy
&& lib.hasInfix "list=\"$(forgejo admin user list \"$@\")\"" s
&& lib.hasInfix "account_listed --admin" s
&& !(lib.hasInfix "forgejo admin user list |" s)
&& !(lib.hasInfix "forgejo admin user list --admin |" s);
}
{
# The absence arm: a forge host without the store has no leaf unless one
# is placed, and the mint says which options to set before it mints.

24
nix/module-eval/grafana.nix
View file

@ -310,6 +310,30 @@ let
&& lib.elem "swarm-bao-grafana-admin.service" unit.after
&& grafanaRemoteAuthelia.systemd.timers ? swarm-bao-grafana-controller-token;
}
{
# The container is ready when the guest's boot finishes, which can be
# before Grafana listens, so the unit waits for the socket inside its own
# start job, ahead of every call that needs it. The wait is bounded and
# sits inside the unit's own timeout, or systemd kills the job first.
name = "the controller's Grafana token waits a bounded time for Grafana's socket before its first call";
ok =
let
unit = grafanaRemoteAuthelia.systemd.services.swarm-bao-grafana-controller-token;
s = unit.script;
parts = lib.splitString "if ! retry_in_job " s;
budget = lib.toInt (lib.head (lib.splitString " " (lib.elemAt parts 1)));
at = needle: lib.stringLength (lib.head (lib.splitString needle s));
in
lib.length parts == 2
&& lib.hasInfix "retry_in_job() {" s
&& lib.hasInfix "${toString budget} grafana_listening; then" s
&& lib.hasInfix "http://localhost/api/health" s
&& budget > 0
&& budget <= 120
&& unit.serviceConfig.TimeoutStartSec == "4min"
&& at "retry_in_job ${toString budget} grafana_listening" < at "no Grafana admin password at"
&& at "retry_in_job ${toString budget} grafana_listening" < at "status=\"$(grafana \"$admin\" GET";
}
{
# Same 403-not-a-miss reason as the matrix and queue arms below: the
# reader's grant covers the `services` prefix, so a path outside it is