From 0fe0df8d63a22b1e66cf6068f1b00f6f66f29579 Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 7 Sep 2026 19:43:29 +0200 Subject: [PATCH] swarm: move the queue's responder package to deploy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `swarm.nats.authPackage` is the callout responder's build — a host decision like every other package in this slice — so it joins the `deploy.nats` block that already holds `enable`, the seed paths and the auto-mint toggle. Its one reader is the `ExecStart` in this file. Three comments moved with it, and none of them survived the move unedited: - The "deliberately NO `package` option" note now says *anywhere* — it argued against a `package` under `swarm.nats`, and after the move a reader's next question is why there isn't one under `deploy.nats` either, where every other service's build now lives. - The description's "see the note above" stopped resolving: the note is ~80 lines up and in a different option block, so it names `options.services.hyperhive.swarm.nats` explicitly. - The split-rationale comment listed "the responder package" among what the queue IS to every hive. It's what the host running it decides, so it moved to that half of the sentence. `flake.nix` writes this option (`lib.mkDefault`), so the writer is repointed too — three of those left, all in the same block. The eval fixture gains the old path rather than a new case: the shim is what a dropped rename would break, and `natsOldPath` already fails the eval if any single entry goes missing. --- flake.nix | 2 +- nix/host-modules/deploy.nix | 4 +++ nix/host-modules/swarm-nats.nix | 51 ++++++++++++++++++--------------- nix/module-eval.nix | 3 +- 4 files changed, 35 insertions(+), 25 deletions(-) diff --git a/flake.nix b/flake.nix index 65763031..2fbdd495 100644 --- a/flake.nix +++ b/flake.nix @@ -151,7 +151,7 @@ services.hyperhive.deploy.swarm-ui.package = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-ui; - services.hyperhive.swarm.nats.authPackage = + services.hyperhive.deploy.nats.authPackage = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.swarm-nats-auth; services.hyperhive.swarm.authelia.bridgePackage = diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix index 034c0f28..45d0836f 100644 --- a/nix/host-modules/deploy.nix +++ b/nix/host-modules/deploy.nix @@ -369,6 +369,10 @@ in [ "services" "hyperhive" "swarm" "ui" "package" ] [ "services" "hyperhive" "deploy" "swarm-ui" "package" ] ) + (lib.mkRenamedOptionModule + [ "services" "hyperhive" "swarm" "nats" "authPackage" ] + [ "services" "hyperhive" "deploy" "nats" "authPackage" ] + ) ]; # ⚠️ `deploy.forgejo` is declared in ./hive-ci.nix, not here, and it is the diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix index 031eeedc..9acd2e56 100644 --- a/nix/host-modules/swarm-nats.nix +++ b/nix/host-modules/swarm-nats.nix @@ -217,12 +217,14 @@ in # ./deploy.nix. What stays here is what the queue IS: its domain, # ports, accounts and callout wiring. - # ⚠️ Deliberately NO `package` option, unlike this module's siblings. - # `services.nats` upstream does not expose one — it resolves - # `pkgs.nats-server` itself — so an option here would either be - # ignored or need an overlay to mean anything, and an option that - # does not control what it names is worse than its absence. Pin the - # build with `nixpkgs.overlays` if you need to. + # ⚠️ Deliberately NO `package` option for the NATS server, anywhere — + # not here and not under `deploy.nats` either, where every other + # service's build now lives. `services.nats` upstream does not expose + # one; it resolves `pkgs.nats-server` itself, so an option would be + # ignored or need an overlay to mean anything, and an option that does + # not control what it names is worse than its absence. Pin the build + # with `nixpkgs.overlays` if you need to. (`deploy.nats.authPackage` + # is a different thing: the callout responder, which IS ours.) port = lib.mkOption { type = lib.types.port; @@ -284,6 +286,19 @@ in ''; }; + }; + + # What stays above is what the queue IS to every hive: the ports it answers + # on and the client id it is registered under. What the host running it + # decides is below — which responder build it runs, whether it mints its own + # keypairs, and where the seeds sit. `enable` already lives in ./deploy.nix, + # which also carries the renames. + # + # ⚠️ The two PUBLIC keys move with their seeds rather than staying: peers + # receive the user key over the wire when they connect (docs/swarm/secrets.md), + # they never configure it, and splitting a keypair across two namespaces is + # worse than either placement. + options.services.hyperhive.deploy.nats = { authPackage = lib.mkOption { type = lib.types.package; defaultText = lib.literalExpression "hyperhive.packages.\${system}.swarm-nats-auth"; @@ -291,25 +306,15 @@ in The auth-callout responder package. ⚠️ Named `authPackage`, not `package`, on purpose: this module - deliberately has **no** `package` option for the server itself - (see the note above — upstream's `services.nats` resolves - `pkgs.nats-server` on its own), so a bare `package` here would - read as "the NATS package" and mean something else entirely. + deliberately has **no** `package` option for the NATS server + itself, because upstream's `services.nats` resolves + `pkgs.nats-server` on its own — see the note above + `options.services.hyperhive.swarm.nats`. A bare `package` here + would read as "the NATS package" and mean something else + entirely. ''; }; - }; - # What stays above is what the queue IS to every hive: the ports it answers - # on, the client id it is registered under, the responder package. The - # callout identity below is what the host running it decides — whether it - # mints its own keypairs, and where the seeds sit. `enable` already lives in - # ./deploy.nix, which also carries the renames. - # - # ⚠️ The two PUBLIC keys move with their seeds rather than staying: peers - # receive the user key over the wire when they connect (docs/swarm/secrets.md), - # they never configure it, and splitting a keypair across two namespaces is - # worse than either placement. - options.services.hyperhive.deploy.nats = { autoGenerateCallout = lib.mkOption { type = lib.types.bool; default = false; @@ -708,7 +713,7 @@ in wantedBy = [ "multi-user.target" ]; serviceConfig = { ExecStart = lib.concatStringsSep " " [ - "${cfg.authPackage}/bin/swarm-nats-auth" + "${deployCfg.nats.authPackage}/bin/swarm-nats-auth" "--nats-url nats://127.0.0.1:${toString cfg.port}" "--user-seed-file \${CREDENTIALS_DIRECTORY}/callout-user.seed" "--issuer-seed-file \${CREDENTIALS_DIRECTORY}/issuer.seed" diff --git a/nix/module-eval.nix b/nix/module-eval.nix index 80bd56d5..1463606e 100644 --- a/nix/module-eval.nix +++ b/nix/module-eval.nix @@ -110,7 +110,7 @@ let # The queue's callout identity, fourth split slice. `autoGenerateCallout` is # left FALSE on purpose: that is what makes the seed paths the thing deciding # `responderConfigured`, so the assertion below is about the seeds rather - # than about the auto-mint branch. All five old paths are defined, so + # than about the auto-mint branch. All six old paths are defined, so # dropping any single shim entry fails the eval, not just the arms read. natsOldPath = hive { deploy.nats.enable = true; @@ -119,6 +119,7 @@ let swarm.nats.calloutIssuerPublicKey = "ATESTISSUERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; swarm.nats.calloutUserSeedFile = "/run/secrets/nats-user.seed"; swarm.nats.calloutIssuerSeedFile = "/run/secrets/nats-issuer.seed"; + swarm.nats.authPackage = pkgs.emptyDirectory; }; # Seventh split slice. Only `usersFile` has a rename entry: the other two