diff --git a/flake.nix b/flake.nix index 65763031..2fbdd495 100644 --- a/flake.nix +++ b/flake.nix @@ -151,7 +151,7 @@ services.hyperhive.deploy.swarm-ui.package = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-ui; - services.hyperhive.swarm.nats.authPackage = + services.hyperhive.deploy.nats.authPackage = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth; services.hyperhive.swarm.authelia.bridgePackage = diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix index 034c0f28..45d0836f 100644 --- a/nix/host-modules/deploy.nix +++ b/nix/host-modules/deploy.nix @@ -369,6 +369,10 @@ in [ "services" "hyperhive" "swarm" "ui" "package" ] [ "services" "hyperhive" "deploy" "swarm-ui" "package" ] ) + (lib.mkRenamedOptionModule + [ "services" "hyperhive" "swarm" "nats" "authPackage" ] + [ "services" "hyperhive" "deploy" "nats" "authPackage" ] + ) ]; # ⚠️ `deploy.forgejo` is declared in ./hive-ci.nix, not here, and it is the diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix index 031eeedc..9acd2e56 100644 --- a/nix/host-modules/swarm-nats.nix +++ b/nix/host-modules/swarm-nats.nix @@ -217,12 +217,14 @@ in # ./deploy.nix. What stays here is what the queue IS: its domain, # ports, accounts and callout wiring. - # ⚠️ Deliberately NO `package` option, unlike this module's siblings. - # `services.nats` upstream does not expose one — it resolves - # `pkgs.nats-server` itself — so an option here would either be - # ignored or need an overlay to mean anything, and an option that - # does not control what it names is worse than its absence. Pin the - # build with `nixpkgs.overlays` if you need to. + # ⚠️ Deliberately NO `package` option for the NATS server, anywhere — + # not here and not under `deploy.nats` either, where every other + # service's build now lives. `services.nats` upstream does not expose + # one; it resolves `pkgs.nats-server` itself, so an option would be + # ignored or need an overlay to mean anything, and an option that does + # not control what it names is worse than its absence. Pin the build + # with `nixpkgs.overlays` if you need to. (`deploy.nats.authPackage` + # is a different thing: the callout responder, which IS ours.) port = lib.mkOption { type = lib.types.port; @@ -284,6 +286,19 @@ in ''; }; + }; + + # What stays above is what the queue IS to every hive: the ports it answers + # on and the client id it is registered under. What the host running it + # decides is below — which responder build it runs, whether it mints its own + # keypairs, and where the seeds sit. `enable` already lives in ./deploy.nix, + # which also carries the renames. + # + # ⚠️ The two PUBLIC keys move with their seeds rather than staying: peers + # receive the user key over the wire when they connect (docs/swarm/secrets.md), + # they never configure it, and splitting a keypair across two namespaces is + # worse than either placement. + options.services.hyperhive.deploy.nats = { authPackage = lib.mkOption { type = lib.types.package; defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-nats-auth"; @@ -291,25 +306,15 @@ in The auth-callout responder package. ⚠️ Named `authPackage`, not `package`, on purpose: this module - deliberately has **no** `package` option for the server itself - (see the note above — upstream's `services.nats` resolves - `pkgs.nats-server` on its own), so a bare `package` here would - read as "the NATS package" and mean something else entirely. + deliberately has **no** `package` option for the NATS server + itself, because upstream's `services.nats` resolves + `pkgs.nats-server` on its own — see the note above + `options.services.hyperhive.swarm.nats`. A bare `package` here + would read as "the NATS package" and mean something else + entirely. ''; }; - }; - # What stays above is what the queue IS to every hive: the ports it answers - # on, the client id it is registered under, the responder package. The - # callout identity below is what the host running it decides — whether it - # mints its own keypairs, and where the seeds sit. `enable` already lives in - # ./deploy.nix, which also carries the renames. - # - # ⚠️ The two PUBLIC keys move with their seeds rather than staying: peers - # receive the user key over the wire when they connect (docs/swarm/secrets.md), - # they never configure it, and splitting a keypair across two namespaces is - # worse than either placement. - options.services.hyperhive.deploy.nats = { autoGenerateCallout = lib.mkOption { type = lib.types.bool; default = false; @@ -708,7 +713,7 @@ in wantedBy = [ "multi-user.target" ]; serviceConfig = { ExecStart = lib.concatStringsSep " " [ - "${cfg.authPackage}/bin/swarm-nats-auth" + "${deployCfg.nats.authPackage}/bin/swarm-nats-auth" "--nats-url nats://127.0.0.1:${toString cfg.port}" "--user-seed-file \${CREDENTIALS_DIRECTORY}/callout-user.seed" "--issuer-seed-file \${CREDENTIALS_DIRECTORY}/issuer.seed" diff --git a/nix/module-eval.nix b/nix/module-eval.nix index 80bd56d5..1463606e 100644 --- a/nix/module-eval.nix +++ b/nix/module-eval.nix @@ -110,7 +110,7 @@ let # The queue's callout identity, fourth split slice. `autoGenerateCallout` is # left FALSE on purpose: that is what makes the seed paths the thing deciding # `responderConfigured`, so the assertion below is about the seeds rather - # than about the auto-mint branch. All five old paths are defined, so + # than about the auto-mint branch. All six old paths are defined, so # dropping any single shim entry fails the eval, not just the arms read. natsOldPath = hive { deploy.nats.enable = true; @@ -119,6 +119,7 @@ let swarm.nats.calloutIssuerPublicKey = "ATESTISSUERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; swarm.nats.calloutUserSeedFile = "/run/secrets/nats-user.seed"; swarm.nats.calloutIssuerSeedFile = "/run/secrets/nats-issuer.seed"; + swarm.nats.authPackage = pkgs.emptyDirectory; }; # Seventh split slice. Only `usersFile` has a rename entry: the other two