From 10fb79efc96d61f131811a799723f0b2d0d49799 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Mon, 21 Sep 2026 17:29:46 +0200
Subject: [PATCH] nix: let nixpkgs own the store collector's Restart
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`services.opentelemetry-collector` already defines
`serviceConfig.Restart = "always"` at the normal priority. The forwarder
added in #4537 defined `"on-failure"` beside it, and two definitions at
one priority are a conflict the module system refuses to resolve — so
`containers.swarm-bao` stopped evaluating at all (#4615).

Drop our definition rather than force a value over it, which is what the
sibling collector in swarm-otel.nix already does. The resolved value is
`"always"`, which is the one we want here: a forwarder that exits for any
reason, clean or not, has stopped shipping the store's journal.
`RestartSec` stays — it conflicts with nothing and is what keeps the
restarts during first-boot secret delivery under the default start-rate
limit.
---
 nix/host-modules/swarm-bao.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 34676bda..e577a988 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -2056,9 +2056,20 @@ in
             # not arrived yet is a collector that says so and retries, not one
             # that quietly exports into a 401. The restart is what closes the
             # first-boot window the host unit's own comment describes.
+            #
+            # ⚠️ `Restart` is deliberately NOT set here, same as the sibling
+            # collector in ./swarm-otel.nix: nixpkgs' own
+            # services/monitoring/opentelemetry-collector.nix already defines it
+            # as `"always"` at the normal priority, so a second definition beside
+            # it is a conflict the module system refuses to resolve rather than a
+            # stricter policy. `"always"` is also the value we want — a forwarder
+            # that exits for any reason, clean or not, has stopped shipping the
+            # store's journal. Only `RestartSec` is ours: systemd's 100ms default
+            # would burn the unit's default start-rate limit while the host unit
+            # is still delivering the secret, leaving it failed rather than
+            # retrying.
             systemd.services.opentelemetry-collector.serviceConfig = {
               LoadCredential = [ "${forwarderCredentialId}:${forwarderSecretInContainer}" ];
-              Restart = "on-failure";
               RestartSec = 15;
             };
           };