swarm: move the queue's responder package to deploy
`swarm.nats.authPackage` is the callout responder's build — a host decision like every other package in this slice — so it joins the `deploy.nats` block that already holds `enable`, the seed paths and the auto-mint toggle. Its one reader is the `ExecStart` in this file. Three comments moved with it, and none of them survived the move unedited: - The "deliberately NO `package` option" note now says *anywhere* — it argued against a `package` under `swarm.nats`, and after the move a reader's next question is why there isn't one under `deploy.nats` either, where every other service's build now lives. - The description's "see the note above" stopped resolving: the note is ~80 lines up and in a different option block, so it names `options.services.hyperhive.swarm.nats` explicitly. - The split-rationale comment listed "the responder package" among what the queue IS to every hive. It's what the host running it decides, so it moved to that half of the sentence. `flake.nix` writes this option (`lib.mkDefault`), so the writer is repointed too — three of those left, all in the same block. The eval fixture gains the old path rather than a new case: the shim is what a dropped rename would break, and `natsOldPath` already fails the eval if any single entry goes missing.
This commit is contained in:
atlas
parent
190763b3a2
commit
0fe0df8d63
4 changed files with 35 additions and 25 deletions
|
|
@ -151,7 +151,7 @@
|
|||
services.hyperhive.deploy.swarm-ui.package =
|
||||
lib.mkDefault
|
||||
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-ui;
|
||||
services.hyperhive.swarm.nats.authPackage =
|
||||
services.hyperhive.deploy.nats.authPackage =
|
||||
lib.mkDefault
|
||||
self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth;
|
||||
services.hyperhive.swarm.authelia.bridgePackage =
|
||||
|
|
|
|||
|
|
@ -369,6 +369,10 @@ in
|
|||
[ "services" "hyperhive" "swarm" "ui" "package" ]
|
||||
[ "services" "hyperhive" "deploy" "swarm-ui" "package" ]
|
||||
)
|
||||
(lib.mkRenamedOptionModule
|
||||
[ "services" "hyperhive" "swarm" "nats" "authPackage" ]
|
||||
[ "services" "hyperhive" "deploy" "nats" "authPackage" ]
|
||||
)
|
||||
];
|
||||
|
||||
# ⚠️ `deploy.forgejo` is declared in ./hive-ci.nix, not here, and it is the
|
||||
|
|
|
|||
|
|
@ -217,12 +217,14 @@ in
|
|||
# ./deploy.nix. What stays here is what the queue IS: its domain,
|
||||
# ports, accounts and callout wiring.
|
||||
|
||||
# ⚠️ Deliberately NO `package` option, unlike this module's siblings.
|
||||
# `services.nats` upstream does not expose one — it resolves
|
||||
# `pkgs.nats-server` itself — so an option here would either be
|
||||
# ignored or need an overlay to mean anything, and an option that
|
||||
# does not control what it names is worse than its absence. Pin the
|
||||
# build with `nixpkgs.overlays` if you need to.
|
||||
# ⚠️ Deliberately NO `package` option for the NATS server, anywhere —
|
||||
# not here and not under `deploy.nats` either, where every other
|
||||
# service's build now lives. `services.nats` upstream does not expose
|
||||
# one; it resolves `pkgs.nats-server` itself, so an option would be
|
||||
# ignored or need an overlay to mean anything, and an option that does
|
||||
# not control what it names is worse than its absence. Pin the build
|
||||
# with `nixpkgs.overlays` if you need to. (`deploy.nats.authPackage`
|
||||
# is a different thing: the callout responder, which IS ours.)
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
|
|
@ -284,6 +286,19 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
# What stays above is what the queue IS to every hive: the ports it answers
|
||||
# on and the client id it is registered under. What the host running it
|
||||
# decides is below — which responder build it runs, whether it mints its own
|
||||
# keypairs, and where the seeds sit. `enable` already lives in ./deploy.nix,
|
||||
# which also carries the renames.
|
||||
#
|
||||
# ⚠️ The two PUBLIC keys move with their seeds rather than staying: peers
|
||||
# receive the user key over the wire when they connect (docs/swarm/secrets.md),
|
||||
# they never configure it, and splitting a keypair across two namespaces is
|
||||
# worse than either placement.
|
||||
options.services.hyperhive.deploy.nats = {
|
||||
authPackage = lib.mkOption {
|
||||
type = lib.types.package;
|
||||
defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-nats-auth";
|
||||
|
|
@ -291,25 +306,15 @@ in
|
|||
The auth-callout responder package.
|
||||
|
||||
⚠️ Named `authPackage`, not `package`, on purpose: this module
|
||||
deliberately has **no** `package` option for the server itself
|
||||
(see the note above — upstream's `services.nats` resolves
|
||||
`pkgs.nats-server` on its own), so a bare `package` here would
|
||||
read as "the NATS package" and mean something else entirely.
|
||||
deliberately has **no** `package` option for the NATS server
|
||||
itself, because upstream's `services.nats` resolves
|
||||
`pkgs.nats-server` on its own — see the note above
|
||||
`options.services.hyperhive.swarm.nats`. A bare `package` here
|
||||
would read as "the NATS package" and mean something else
|
||||
entirely.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# What stays above is what the queue IS to every hive: the ports it answers
|
||||
# on, the client id it is registered under, the responder package. The
|
||||
# callout identity below is what the host running it decides — whether it
|
||||
# mints its own keypairs, and where the seeds sit. `enable` already lives in
|
||||
# ./deploy.nix, which also carries the renames.
|
||||
#
|
||||
# ⚠️ The two PUBLIC keys move with their seeds rather than staying: peers
|
||||
# receive the user key over the wire when they connect (docs/swarm/secrets.md),
|
||||
# they never configure it, and splitting a keypair across two namespaces is
|
||||
# worse than either placement.
|
||||
options.services.hyperhive.deploy.nats = {
|
||||
autoGenerateCallout = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
|
|
@ -708,7 +713,7 @@ in
|
|||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = lib.concatStringsSep " " [
|
||||
"${cfg.authPackage}/bin/swarm-nats-auth"
|
||||
"${deployCfg.nats.authPackage}/bin/swarm-nats-auth"
|
||||
"--nats-url nats://127.0.0.1:${toString cfg.port}"
|
||||
"--user-seed-file \${CREDENTIALS_DIRECTORY}/callout-user.seed"
|
||||
"--issuer-seed-file \${CREDENTIALS_DIRECTORY}/issuer.seed"
|
||||
|
|
|
|||
|
|
@ -110,7 +110,7 @@ let
|
|||
# The queue's callout identity, fourth split slice. `autoGenerateCallout` is
|
||||
# left FALSE on purpose: that is what makes the seed paths the thing deciding
|
||||
# `responderConfigured`, so the assertion below is about the seeds rather
|
||||
# than about the auto-mint branch. All five old paths are defined, so
|
||||
# than about the auto-mint branch. All six old paths are defined, so
|
||||
# dropping any single shim entry fails the eval, not just the arms read.
|
||||
natsOldPath = hive {
|
||||
deploy.nats.enable = true;
|
||||
|
|
@ -119,6 +119,7 @@ let
|
|||
swarm.nats.calloutIssuerPublicKey = "ATESTISSUERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
||||
swarm.nats.calloutUserSeedFile = "/run/secrets/nats-user.seed";
|
||||
swarm.nats.calloutIssuerSeedFile = "/run/secrets/nats-issuer.seed";
|
||||
swarm.nats.authPackage = pkgs.emptyDirectory;
|
||||
};
|
||||
|
||||
# Seventh split slice. Only `usersFile` has a rename entry: the other two
|
||||
|
|
|
|||
Loading…
Reference in a new issue