mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add a semi-spread example deploy and a check that evaluates it

Browse source
This commit is contained in:
atlas 2026-11-09 18:05:27 +01:00 • committed by mara
commit 538da5a13a
1 changed files with 875 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

64
docs/examples/semi-spread/swarm-services.nix Normal file
View file

@ -0,0 +1,64 @@
# swarm-services: the forge, the matrix homeserver, SSO, the queue, and the
# metrics and log stack.
{ config, lib, ... }:
let
hyperhive = config.services.hyperhive;
# The secret store runs on swarm-central, so each service here reads it with
# a leaf copied from there. `pair "grafanaOidc" "grafana-oidc"` names the
# options `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
# `grafana-oidc.pem` and `grafana-oidc-key.pem`.
pki = "/var/lib/swarm-pki";
pair = option: stem: {
"${option}ClientCertFile" = "${pki}/${stem}.pem";
"${option}ClientKeyFile" = "${pki}/${stem}-key.pem";
};
in
{
services.hyperhive = {
# Everything once-per-swarm that is not placed elsewhere below.
deploy.allSwarmServices = true;
# The forge and the matrix homeserver are public, and so is the SSO login
# they send browsers to.
gateway.openFirewall = true;
deploy.bao = lib.mergeAttrsList [
{ enable = false; }
(pair "forgePublisher" "forge-publisher")
(pair "servicesIssuer" "services-issuer")
(pair "grafanaOidc" "grafana-oidc")
(pair "otelOidc" "otel-oidc")
(pair "forwarderOidc" "forwarder-oidc")
(pair "reviewClassifier" "review-classifier")
(pair "notifyRouter" "notify-router")
(pair "claudeLogin" "claude-login")
(pair "ciMetrics" "ci-metrics")
];
deploy.matrix = {
ctlBaoClientCertFile = "${pki}/matrix-ctl.pem";
ctlBaoClientKeyFile = "${pki}/matrix-ctl-key.pem";
};
deploy.nats = {
baoClientCertFile = "${pki}/nats.pem";
baoClientKeyFile = "${pki}/nats-key.pem";
authBaoClientCertFile = "${pki}/nats-auth.pem";
authBaoClientKeyFile = "${pki}/nats-auth-key.pem";
};
deploy.swarm-secret-publisher = {
baoClientCertFile = "${pki}/secret-publisher.pem";
baoClientKeyFile = "${pki}/secret-publisher-key.pem";
};
deploy.victoriametrics = {
authBaoClientCertFile = "${pki}/metrics-auth.pem";
authBaoClientKeyFile = "${pki}/metrics-auth-key.pem";
};
deploy.victorialogs = {
authBaoClientCertFile = "${pki}/logs-auth.pem";
authBaoClientKeyFile = "${pki}/logs-auth-key.pem";
};
};
# The queue is reachable over the VPN only.
networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.nats.port ];
}