vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: share the service-container settings through one in-container module

Browse source 
The ten hand-rolled `containers.<name>` blocks each repeat the same
in-container lines: `system.stateVersion`, a firewall turned off because
the container shares the host netns, and resolvconf forced off because
something in the container writes /etc/resolv.conf itself.

`nix/host-modules/swarm-container.nix` now owns those lines. It is
imported inside the container's own config and exposes
`services.hyperhive.swarmContainer.{privateNetwork,writesOwnResolvConf}`
for the host module to set. `stateVersion` is a `mkDefault`, so the two
containers on another value can keep theirs. `--link-journal=host` stays
per module, and so do the host-side attrs (autoStart, ephemeral,
privateNetwork, bindMounts).

swarm-victoriametrics is converted as the first user. Its container
toplevel drvPath is unchanged. A module-eval case now forces that
container's config, which nothing in the suite read before.

Refs #3773
This commit is contained in:
atlas 2026-09-29 18:49:48 +02:00 • committed by mara
commit 024067f3f8
3 changed files with 74 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

52
nix/host-modules/swarm-container.nix Normal file
View file

@ -0,0 +1,52 @@
# What every hyperhive service nixos-container sets for itself, imported
# inside the container's own `config`.
#
# The host module that declares `containers.<name>` sets the options below.
# They restate host-side facts the container cannot read on its own: its
# evaluation is nested inside `containers.<name>`, and reading the host side
# back from in here recurses.
{ config, lib, ... }:
let
cfg = config.services.hyperhive.swarmContainer;
in
{
options.services.hyperhive.swarmContainer = {
privateNetwork = lib.mkOption {
type = lib.types.bool;
description = ''
Must equal the host-side `containers.<name>.privateNetwork`. When
`false` the container shares the host netns, so its own
firewall.service would rewrite the HOST ruleset at every boot; the
container's firewall is turned off and the host firewall owns all
filtering.
'';
};
writesOwnResolvConf = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Something in this container writes `/etc/resolv.conf` itself (the
`swarm-container-resolver.nix` unit, or a static file), so
resolvconf is forced off. Left on, host-tracking would regenerate the
file empty, since the host's copy doesn't cross the boundary after
start.
'';
};
};
config = lib.mkMerge [
{
# A container that sets its own keeps it. Changing this value changes
# it for every container that doesn't, and that is a state migration
# for each of them.
system.stateVersion = lib.mkDefault "26.05";
}
(lib.mkIf (!cfg.privateNetwork) {
networking.firewall.enable = false;
})
(lib.mkIf cfg.writesOwnResolvConf {
networking.resolvconf.enable = lib.mkForce false;
})
];
}

21
nix/host-modules/swarm-victoriametrics.nix
View file

@ -27,6 +27,10 @@ let
# the required-domain assertion in hive-network.nix should be what an
# operator sees, not a coercion error from here.
domainBase = if swarmDomain == null then "invalid" else swarmDomain;
# Shared host netns, like every sibling swarm container: the gateway
# reaches this at 127.0.0.1:<port>.
privateNetwork = false;
in
{
# What stays here is what the store IS from any hive's point of view: the
@ -190,31 +194,20 @@ in
# Journal files on the host, not inside the container: nixpkgs hardcodes
# --link-journal=try-guest, and EXTRA_NSPAWN_FLAGS expands after it.
extraFlags = [ "--link-journal=host" ];
# Shared host netns, like every sibling swarm container: the gateway
# reaches this at 127.0.0.1:<port>.
privateNetwork = false;
inherit privateNetwork;
config =
{ ... }:
{
imports = [
./swarm-container.nix
(import ./swarm-container-resolver.nix {
inherit (networkCfg) bridgeIp;
dnsConsumers = [ "victoriametrics.service" ];
})
];
system.stateVersion = "26.05";
# This container shares the host netns, so its own firewall.service
# would rewrite the HOST ruleset at every boot. The host firewall
# owns all filtering.
networking.firewall.enable = false;
# resolvconf stays off because the resolver unit imported above
# owns /etc/resolv.conf. Leaving it on would let host-tracking
# regenerate the file empty, since the host's copy doesn't cross
# the boundary after start.
networking.resolvconf.enable = lib.mkForce false;
services.hyperhive.swarmContainer = { inherit privateNetwork; };
services.victoriametrics = {
enable = true;