mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

start the forge mint unit from the trust refresh

Browse source 
a late store root dependency-fails forgejo-swarm-controller-account on
first boot and the refresh never started it, so the controller got no
forge token (vm-nightly #7084). list it as a trust consumer.

Closes #6109
This commit is contained in:
atlas 2026-11-06 15:45:34 +01:00
commit 47ec47e25b
2 changed files with 23 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/hive-forge/default.nix
View file

@ -581,13 +581,17 @@ in
# just the obvious one: `forgejo-sso-source` fetches the issuer's
# `.well-known/openid-configuration` under the store's root, and it
# once shipped without the trust its sibling had. The collector is
# Go too, for the swarm collector's and authelia's names.
# Go too, for the swarm collector's and authelia's names. The mint
# unit is a consumer so that the refresh starts it: it `Requires=`
# forgejo, so a first boot with a late root leaves it
# dependency-failed and nothing else starts it.
(caTrust.trustBundle {
inherit pkgs;
name = "hive-forge";
consumers = [
"forgejo"
"forgejo-sso-source"
mintUnit
"opentelemetry-collector"
];
})

18
nix/module-eval/forge-placement.nix
View file

@ -391,6 +391,24 @@ let
))
&& lib.elem "forgejo-swarm-controller-account.service" c.swarm-bridge-dns.before;
}
{
# A first boot with a late store root dependency-fails forgejo and the
# mint; the refresh's `start` is the only thing that brings the mint
# back. The controls are the sibling consumers in the same command, and
# the mint's `after`/`requires` on forgejo, which order the two
# `--no-block` starts.
name = "the forge's trust refresh starts the mint unit, and the mint stays ordered after forgejo";
ok =
let
c = allLocal.containers.hive-forge.config.systemd.services;
u = mint allLocal;
in
lib.hasInfix "systemctl start --no-block forgejo.service forgejo-sso-source.service forgejo-swarm-controller-account.service" c.hive-forge-ca-bundle-refresh.script
&& lib.elem "hive-forge-ca-bundle.service" u.requires
&& lib.elem "hive-forge-ca-bundle.service" u.after
&& lib.elem "forgejo.service" u.after
&& lib.elem "forgejo.service" u.requires;
}
{
# The mint is in the forge container's boot wait (a oneshot in
# `multi-user.target`), so what it waits for inside its start stays under