vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

refactor(nix): make all-local a deployment mode, not a default

Browse source 
mara: enableAllLocalDefaults is more of a deployment mode via settings
set, less a default setting.

That reframing is the change. A mode asserts values; an option declares
what it is when nobody asks. Written as default = <flag>, every service
option had to name a switch it has no relationship to, and the answer to
what does all-local turn on was spread across five files.

Two modules now hold the two tiers - local-defaults.nix for the mode and
what it asserts directly, swarm-required-services.nix for the
services-live-here switch and the per-service enables under it. Each
service module keeps its own declaration and loses only the line about
when a deployment wants it.

mkDefault is the right precedence rather than a compromise: it beats an
option default and yields to any explicit definition, so the mode fills
in for an operator who has not spoken and never argues with one who has.
Evaluated config is unchanged in both directions.
This commit is contained in:
atlas 2026-08-05 19:41:11 +02:00
commit 048bdd29a8
8 changed files with 134 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/host-modules/swarm-authelia.nix
View file

@ -5,9 +5,9 @@
#
# - the CLIENT pointer (`url`) exists on every hive, because a hive
# that doesn't run authelia still has to know where to send people.
# - the CONTAINER only exists where the swarm's shared services live
# (`swarm.enableRequiredServices`, itself defaulting from
# `enableAllLocalDefaults`). A hive is a client by default.
# - the CONTAINER only exists where the swarm's shared services live.
# `swarm.enableRequiredServices` asserts this module's `enable`
# (see ./swarm-required-services.nix); a hive is a client by default.
#
# Operator and agents are both subjects of the same provider,
# differentiated by roles/claims rather than by mechanism — there is one
@ -31,7 +31,6 @@
let
cfg = config.services.hyperhive.swarm.authelia;
hyperhiveCfg = config.services.hyperhive;
swarmCfg = config.services.hyperhive.swarm;
hyperhiveDomain = hyperhiveCfg.domain;
# Upstream's `services.authelia.instances.<name>` derives the unit,
@ -51,14 +50,13 @@ in
options.services.hyperhive.swarm.authelia = {
enable = lib.mkOption {
type = lib.types.bool;
default = swarmCfg.enableRequiredServices;
defaultText = lib.literalExpression "services.hyperhive.swarm.enableRequiredServices";
default = false;
example = true;
description = ''
Run the swarm's authelia in a `swarm-authelia` container on this
host. Defaults from
`services.hyperhive.swarm.enableRequiredServices` — a swarm has
one SSO provider, and this says it lives here.
host. `services.hyperhive.swarm.enableRequiredServices` turns
this on — a swarm has one SSO provider, and that says it lives
here.
With it off, this hive is a *client*: `url` below still points
at whoever runs it, and no container is created.