mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the swarm wireguard mesh; tombstone its options

Browse source
This commit is contained in:
atlas 2026-11-15 02:17:44 +01:00
commit adc61c9043
1 changed files with 330 additions and 1068 deletions
Download patch file Download diff file Expand all files Collapse all files

92
nix/host-modules/swarm.nix
View file

@ -11,10 +11,7 @@
# detected it. One entry per hive makes that unrepresentable.
#
# Consumed by swarm-controller's own hive directory (its `/api/hives`,
# swarm-controller.nix) and the mesh in ./swarm-wireguard.nix. The mesh
# lives there rather than here because bringing up an interface is
# host networking rather than swarm bookkeeping, and a host that runs
# no hive still needs it.
# swarm-controller.nix).
{
lib,
config,
@ -27,6 +24,30 @@ let
hiveNames = lib.attrNames swarmCfg.hives;
# Per-hive fields of the removed WireGuard mesh. Declared hidden so a
# directory that still sets one reaches the assertion below. A removed
# option cannot be tombstoned with `mkRemovedOptionModule` here: it writes
# top-level `assertions`, which a submodule does not have.
removedMeshFields = [
"wireguardPublicKey"
"wireguardEndpoint"
"wireguardAddress"
];
removedMeshOptions = lib.genAttrs removedMeshFields (
_:
lib.mkOption {
type = lib.types.nullOr lib.types.raw;
default = null;
visible = false;
}
);
meshFieldsSet = lib.concatMap (
name:
map (field: "${name}.${field}") (
lib.filter (f: swarmCfg.hives.${name}.${f} != null) removedMeshFields
)
) hiveNames;
nameGuards = import ./lib/name-guards.nix { inherit lib; };
# Names no hive may BE, and words no hive name may CONTAIN. Both files
@ -166,62 +187,15 @@ in
something else.
'';
};
wireguardPublicKey = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "base64pubkey=";
description = ''
WireGuard public key for this hive's host. Required when
`services.hyperhive.deploy.wireguard.enable = true` and
you want this hive reachable over the mesh. Null = TLS-
only peering (public internet, no mesh tunnel).
'';
};
wireguardEndpoint = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "203.0.113.1:51820";
description = ''
WireGuard endpoint for this hive in `host:port` form.
Null = this hive has no reachable endpoint, so the tunnel
is initiated from the other side.
Reads like a fact about the relationship and is not: it
says whether *this* hive can be dialled, which every other
hive in the swarm needs the same answer to.
'';
};
wireguardAddress = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "10.100.0.2/32";
description = ''
IP address (with prefix) of this hive's host on the
WireGuard mesh. Used as the `allowedIPs` for its
WireGuard config entry (`./swarm-wireguard.nix`), so
intra-swarm traffic can route over the mesh address
rather than the public domain. Required to include
a hive in the mesh (entries missing this field are
silently excluded from `wg-hive`).
'';
};
};
}
// removedMeshOptions;
}
)
);
default = { };
example = {
pr1ma = {
wireguardAddress = "10.100.0.1/32";
wireguardEndpoint = "203.0.113.1:51820";
};
edge = {
domain = "edge.elsewhere.example";
wireguardAddress = "10.100.0.2/32";
};
pr1ma = { };
edge.domain = "edge.elsewhere.example";
};
description = ''
Every hive in this swarm, keyed by `hiveName` — **including this
@ -289,6 +263,14 @@ in
);
assertions = [
{
assertion = meshFieldsSet == [ ];
message = ''
The WireGuard mesh was removed; bao and nats are reached
through their routable listeners. Remove services.hyperhive.swarm.hives.<name>.wireguard{PublicKey,Endpoint,Address}
from: ${lib.concatStringsSep ", " meshFieldsSet}.
'';
}
(nameGuards.mustBeIdent {
option = "services.hyperhive.swarm.hives";
names = hiveNames;