vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

deploy: move the controller and swarm-ui toggles

Browse source 
One commit rather than two because they are not independent: the UI's
`enable` had the controller's as its literal default, so moving the
controller alone would leave the UI's default naming an option that no
longer exists.

The UI keeps that derivation in its new home — it is a view onto the
controller's state and reaches it over that daemon's unix socket, so the
host running the controller is the host that can serve it.

Three spellings had to move together for the UI, not one: the `default`,
the `defaultText` shown in the options doc, and the description prose
that names the old path in words. A grep for the option path finds the
first two.

The sweep also reached outside nix: `swarm-controller`'s crate README and
its `//!` module doc both named the option, as did this repo's own
CLAUDE.md and four pages under docs/. An option's name is API, and its
documentation lives wherever someone thought to write it down.
This commit is contained in:
atlas 2026-08-30 03:22:42 +02:00 • committed by mara
commit 0b7357d4b8
16 changed files with 75 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nix/host-modules/swarm-controller.nix
View file

@ -15,6 +15,7 @@
}:
let
cfg = config.services.hyperhive.swarm.controller;
deployCfg = config.services.hyperhive.deploy;
autheliaCfg = config.services.hyperhive.swarm.authelia;
# What `swarmctl` needs in order to act on authelia from the host.
@ -119,7 +120,7 @@ let
# ⚠️ Correct ONLY while the vhost and this daemon share a host, and they do
# by construction: the UI's `/api/` location proxies
# `http://unix:<socketPath>`, a path that resolves nowhere else, and this
# daemon binds no TCP address at all (see the header). `swarm.ui.enable`
# daemon binds no TCP address at all (see the header). `deploy.swarm-ui`
# therefore is not a guess about *some* host publishing the endpoint — it is
# the flag that declares that vhost, on the box holding the socket.
#
@ -129,7 +130,7 @@ let
# the moment to add an explicit `publicUrl` option — not before, because
# until then there is exactly one derivable answer and an option would only
# be a second place to get it wrong.
webhookEnv = lib.optionalAttrs uiCfg.enable {
webhookEnv = lib.optionalAttrs deployCfg.swarm-ui {
SWARM_CONTROLLER_PUBLIC_URL = "https://${uiCfg.domain}";
};
@ -214,7 +215,7 @@ in
name = "swarm-controller";
consumers = [ "swarm-controller" ];
hostUnit = true;
enable = cfg.enable;
enable = deployCfg.controller;
})
];
@ -238,22 +239,12 @@ in
'';
};
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Run the swarm-controller daemon on this host. Off by default and
deliberately not derived from `services.hyperhive.enable`: a swarm
has one controller, so enabling it per hive is a decision about
swarm topology, not about whether hyperhive is installed.
`services.hyperhive.enableAllLocalDefaults` does assert it, and
that is not an exception to the rule above — it is the rule
applied. That mode says "this box is the whole deployment", which
answers the topology question outright, where
`services.hyperhive.enable` alone never can.
'';
};
# `enable` moved to `services.hyperhive.deploy.controller` — see
# ./deploy.nix. `services.hyperhive.enableAllLocalDefaults` still
# asserts it, and that was never an exception to "not derived from
# services.hyperhive.enable": that mode says "this box is the whole
# deployment", which answers the topology question outright, where
# `enable` alone never can. What stays here is what the daemon IS.
package = lib.mkOption {
type = lib.types.package;
@ -483,7 +474,7 @@ in
};
};
config = lib.mkIf (config.services.hyperhive.enable && cfg.enable) {
config = lib.mkIf (config.services.hyperhive.enable && deployCfg.controller) {
# The daemon and the oneshot that mints its credential — the second one
# failing leaves the first running and unable to authenticate anywhere.
services.hyperhive.swarm.otel.journaldUnits = [