mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-nats: the auth responder has no start limit, always restarts, and is started after the server's restarts

Browse source
This commit is contained in:
atlas 2026-11-12 06:00:53 +01:00 • committed by mara
commit 8530a5b7fd
2 changed files with 70 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/module-eval/nats-authelia.nix
View file

@ -381,6 +381,22 @@ let
natsOnStoreHost
];
}
{
# A burst of starts must not leave the responder failed, and a stop
# from the server failing must not leave it down: no start limit and
# `Restart=always`. `RestartSec` is the control that the lookup reaches
# the unit's real `serviceConfig`; the callout key fetch starts the
# responder after it restarts the server.
name = "the queue's responder has no start limit, always restarts, and is started after the key fetch";
ok =
let
r = responderOf natsQueueOnly;
in
r.startLimitIntervalSec == 0
&& r.serviceConfig.Restart == "always"
&& r.serviceConfig.RestartSec == "5s"
&& lib.hasInfix "start --no-block swarm-nats-auth.service" natsWithStoreIdentity.systemd.services.swarm-bao-nats-callout-xkey.script;
}
{
# A server that starts late, once its xkey arrives, must bring the
# responder with it: the responder requires the server, so a server that

12
nix/module-eval/nats-tls.nix
View file

@ -225,6 +225,18 @@ let
&& lib.hasInfix "[ -s /var/lib/swarm-bao-pki/nats.pem ]" allLocal.systemd.services.swarm-bao-pki.script
&& lib.hasInfix "swarm-nats \"\" clientAuth" allLocal.systemd.services.swarm-bao-pki.script;
}
{
# The leaf rotation restarts the server; the responder, stopped when
# the server failed, is cleared and started after it.
name = "the leaf rotation starts the responder after restarting the server";
ok =
let
s = leafUnit.script;
in
lib.hasInfix "restart nats.service" s
&& lib.hasInfix "reset-failed swarm-nats-auth.service" s
&& lib.hasInfix "start --no-block swarm-nats-auth.service" s;
}
{
# The hive's own reader is not the queue's identity, and no path is
# derived from it: a queue host without the store that holds only the