vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

fix(#3343): move the all-local queue derivations into the deployment mode

Browse source 
Review point: the co-located defaults are an auto-deploy special case and
belong with the other ones, not inside each option's own default. An
option should describe itself; the mode describes what a deployment shape
implies. local-defaults.nix already says exactly this in its header.

Options now default to empty (= unset, which the assertions refuse), and
enableAllLocalDefaults fills in loopback + the minted secret path.
This commit is contained in:
atlas 2026-08-16 19:30:43 +02:00
commit 072dbd80a7
2 changed files with 43 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

32
nix/host-modules/swarm-controller.nix
View file

@ -189,19 +189,19 @@ in
queue = {
natsUrl = lib.mkOption {
type = lib.types.str;
default = lib.optionalString natsCfg.enable "nats://127.0.0.1:${toString natsCfg.port}";
defaultText = lib.literalExpression ''
if swarm.nats.enable then "nats://127.0.0.1:''${toString swarm.nats.port}" else ""
'';
default = "";
example = "nats://queue.example.com:4222";
description = ''
Where the controller reaches the swarm queue.
Defaults to loopback when this host runs the queue — the queue
container shares the host netns, so that address is correct
here and is not the `localhost`-means-the-agent trap that
applies inside agent containers. Set it explicitly when the
queue lives elsewhere.
Empty means unset, which the assertion below refuses — a
controller with no queue is not a lighter controller.
`enableAllLocalDefaults` fills this in with loopback, because
that address is only correct when the queue is on this host:
its container shares the host netns. That derivation lives with
the mode rather than here, so this option describes itself
rather than a deployment shape.
'';
};
@ -221,20 +221,18 @@ in
clientSecretFile = lib.mkOption {
type = lib.types.str;
default = lib.optionalString autheliaCfg.enable "${autheliaCfg.hostClientSecretDir}/${queueClientId}.secret";
defaultText = lib.literalExpression ''
"''${swarm.authelia.hostClientSecretDir}/swarm-controller.secret"
'';
default = "";
example = "/var/lib/secrets/swarm-controller-queue.secret";
description = ''
Path on **this** host holding the plaintext of the controller's
OAuth2 client secret. A path, never a value: the secret would
otherwise land in the world-readable nix store.
Defaults to the file authelia's first-boot generator mints when
authelia runs here. When it doesn't, the operator places the
secret and names it — the controller cannot mint its own,
because minting happens inside authelia's state directory.
The controller cannot mint its own — minting happens inside
authelia's state directory during its first boot — so away from
that host the operator places the secret and names it here.
`enableAllLocalDefaults` points this at the minted file, which
is exactly the case where one exists locally.
Read by `LoadCredential`, so it needs to be readable by root at
unit start and nothing more; the daemon's own user never sees