From 3a77e869eb3bb1f2b3eb5655f137c9bef3d26ad8 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Thu, 5 Nov 2026 09:26:30 +0100
Subject: [PATCH] module-eval: give the Grafana stand-in a mainProgram, so
 upstream's getExe stops warning

---
 nix/module-eval/grafana.nix          | 11 ++++++-----
 nix/module-eval/lib.nix              |  8 ++++++++
 nix/module-eval/secret-publisher.nix |  3 ++-
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/nix/module-eval/grafana.nix b/nix/module-eval/grafana.nix
index 7e93786b..29377bca 100644
--- a/nix/module-eval/grafana.nix
+++ b/nix/module-eval/grafana.nix
@@ -18,6 +18,7 @@ let
         nixosSystem
         ;
     })
+    grafanaStub
     hive
     runGroup
     ;
@@ -27,7 +28,7 @@ let
     deploy.grafana.datasourceUrl = "http://127.0.0.1:19999";
     deploy.grafana.logsDatasourceUrl = "http://127.0.0.1:19998";
     deploy.grafana.plugins = [ ];
-    deploy.grafana.package = pkgs.emptyDirectory;
+    deploy.grafana.package = grafanaStub;
   };
 
   # A host that tries to move the socket directory; reading the option throws.
@@ -35,7 +36,7 @@ let
     deploy.grafana.enable = true;
     deploy.grafana.socketDir = "/run/test-grafana-sock";
     deploy.grafana.plugins = [ ];
-    deploy.grafana.package = pkgs.emptyDirectory;
+    deploy.grafana.package = grafanaStub;
   };
 
   # Same pairing `nix/module-eval/bao-otel-collector.nix` uses for its own
@@ -55,7 +56,7 @@ let
   grafanaWithAuthelia = hive {
     deploy.grafana.enable = true;
     deploy.grafana.plugins = [ ];
-    deploy.grafana.package = pkgs.emptyDirectory;
+    deploy.grafana.package = grafanaStub;
     deploy.authelia.enable = true;
     deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
     deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
@@ -70,7 +71,7 @@ let
   grafanaRemoteAuthelia = hive {
     deploy.grafana.enable = true;
     deploy.grafana.plugins = [ ];
-    deploy.grafana.package = pkgs.emptyDirectory;
+    deploy.grafana.package = grafanaStub;
     swarm.authelia.url = "https://auth.example.invalid";
     deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
     deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
@@ -86,7 +87,7 @@ let
   grafanaNoIdentity = hive {
     deploy.grafana.enable = true;
     deploy.grafana.plugins = [ ];
-    deploy.grafana.package = pkgs.emptyDirectory;
+    deploy.grafana.package = grafanaStub;
     swarm.authelia.url = "https://auth.example.invalid";
     # Declares a vhost that binds its own `listen`, which the gateway refuses.
     gateway.vhosts."own-listen.t.local".listen = [ ];
diff --git a/nix/module-eval/lib.nix b/nix/module-eval/lib.nix
index fa10706f..969b91a5 100644
--- a/nix/module-eval/lib.nix
+++ b/nix/module-eval/lib.nix
@@ -301,9 +301,17 @@ let
       );
     in
     builtins.foldl' (acc: v: builtins.seq v acc) true vals;
+
+  # A stand-in for the Grafana package in the cases that do not run it. Upstream's
+  # Grafana module takes the executable's name from `meta.mainProgram`, and
+  # warns when a package has none.
+  grafanaStub = pkgs.emptyDirectory // {
+    meta.mainProgram = "grafana";
+  };
 in
 {
   inherit hive hiveWith;
+  inherit grafanaStub;
   inherit hiveWithController;
   inherit agent;
   inherit agentWith;
diff --git a/nix/module-eval/secret-publisher.nix b/nix/module-eval/secret-publisher.nix
index 9a89d707..4310e384 100644
--- a/nix/module-eval/secret-publisher.nix
+++ b/nix/module-eval/secret-publisher.nix
@@ -18,6 +18,7 @@ let
         nixosSystem
         ;
     })
+    grafanaStub
     hive
     runGroup
     ;
@@ -56,7 +57,7 @@ let
   grafanaRemoteAuthelia = hive {
     deploy.grafana.enable = true;
     deploy.grafana.plugins = [ ];
-    deploy.grafana.package = pkgs.emptyDirectory;
+    deploy.grafana.package = grafanaStub;
     swarm.authelia.url = "https://auth.example.invalid";
     deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
     deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";