mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

bound the forge's SSO source setup and retry it with a growing delay

Browse source
This commit is contained in:
atlas 2026-11-02 01:52:17 +01:00
commit 3b8ab17240
1 changed files with 29 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/module-eval/swarm-services-switch.nix
View file

@ -267,10 +267,6 @@ let
"victoriametrics.service"
];
}
{
why = "known gap: registering the login source makes an outbound HTTPS call to authelia, and the unit has neither a timeout nor a Restart=";
units = [ "forgejo-sso-source.service" ];
}
];
allowedUnstated =
key:
@ -1441,7 +1437,7 @@ let
}
{
# The presence arms for the check above: it reads real units and real
# limits. Each named unit states its budget (30 s, 30 s, 30 s, 20 s, 20 s),
# limits. Each named unit states its budget (30 s, 30 s, 30 s, 30 s, 20 s, 20 s),
# so it is found at a limit equal to it and not one second above (the
# boundary), and the container limits are the ones the check reads.
name = "the boot-wait check finds the units that state a budget, at the boundary, and reads each container's own limit";
@ -1453,8 +1449,11 @@ let
secrets = "authelia-swarm-secrets.service";
sync = "swarm-matrix-appservice-sync.service";
render = "swarm-matrix-appservice-render.service";
sso = "forgejo-sso-source.service";
in
lib.elem mint (keys "hive-forge" 30)
&& lib.elem sso (keys "hive-forge" 30)
&& !(lib.elem sso (keys "hive-forge" 31))
&& lib.elem fetch (keys "hive-forge" 30)
&& !(lib.elem mint (keys "hive-forge" 31))
&& !(lib.elem fetch (keys "hive-forge" 31))
@ -1480,9 +1479,16 @@ let
sc = u.serviceConfig;
in
sc.Restart == "on-failure" && sc.RestartSteps > 0 && sc.RestartMaxDelaySec > sc.RestartSec;
forge = serviceContainers.hive-forge.config.systemd.services;
authelia = serviceContainers.swarm-authelia.config.systemd.services;
in
grows serviceContainers.hive-forge.config.systemd.services.forgejo-swarm-controller-account
grows forge.forgejo-swarm-controller-account
&& grows forge.forgejo-sso-source
&& forge.forgejo-sso-source.serviceConfig.TimeoutStartSec == 30
# Both registration calls fetch the issuer's discovery document and
# run under a client timeout.
&& lib.hasInfix "timeout --kill-after=3 20 forgejo admin auth add-oauth" forge.forgejo-sso-source.script
&& lib.hasInfix "timeout --kill-after=3 20 forgejo admin auth update-oauth" forge.forgejo-sso-source.script
&& grows authelia.authelia-swarm-secrets
&& authelia.swarm-authelia-bridge.serviceConfig.TimeoutStartSec == 10;
}