From 13b1b41172d9bac02f906000105cbb6fdcb3cfea Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 30 Aug 2026 04:11:57 +0200 Subject: [PATCH] local-defaults: assert the controller through deploy, not the old alias Round-3 review catch: the all-local mode still set `services.hyperhive.swarm.controller.enable` -- the exact path this branch's own `mkRenamedOptionModule` deprecates. It forwards correctly, so nothing broke, but every eval with `enableAllLocalDefaults = true` printed a deprecation warning and the tree depended on the shim it is retiring. It survived the rewrite because the path is SPLIT ACROSS NESTING: `swarm = { controller.enable = ...; }`. No grep for a dotted path can match text that is not contiguous -- not the prefix-anchored pattern the rewrite used, and not the suffix-anchored one added after that missed hive-tls.nix. What finds it is the bare tail with no prefix at all (`^\s*controller\.enable\s*=`), which reports exactly one hit outside deploy.nix's declarations. The assignment moves out of the `swarm` attrset rather than staying in it: `deploy.*` is a different top-level path, so the collision the neighbouring warning describes -- two definitions of `swarm`, the nested one silently lost -- does not apply. --- nix/host-modules/local-defaults.nix | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/nix/host-modules/local-defaults.nix b/nix/host-modules/local-defaults.nix index 732c43c7..5034eee5 100644 --- a/nix/host-modules/local-defaults.nix +++ b/nix/host-modules/local-defaults.nix @@ -80,15 +80,6 @@ in # reach whoever runs the responder, and minting them here would move # that hand-off somewhere less visible rather than removing it. nats.autoGenerateCallout = lib.mkDefault cfg.enableAllLocalDefaults; - # The controller is asserted by the MODE and by nothing else. Its own - # option stays `default = false` precisely because running it is a - # statement about swarm topology — but "this box is the whole - # deployment" IS that statement, and it is the one shape where the - # answer isn't ambiguous. Deriving it from `enableRequiredServices` - # instead would be wrong: a hive in a larger swarm can legitimately - # want the shared services without being the host that controls them. - controller.enable = lib.mkDefault cfg.enableAllLocalDefaults; - # The controller's queue coordinates. Co-location is what makes these # derivable at all — loopback only reaches the queue when the queue is # here, and the minted client secret only exists on the host authelia @@ -117,4 +108,19 @@ in lib.mkDefault "${config.services.hyperhive.swarm.authelia.hostClientSecretDir}/swarm-controller.secret" ); }; + + # The controller is asserted by the MODE and by nothing else. Its own + # option stays `default = false` precisely because running it is a + # statement about swarm topology — but "this box is the whole + # deployment" IS that statement, and it is the one shape where the + # answer isn't ambiguous. Deriving it from `enableRequiredServices` + # instead would be wrong: a hive in a larger swarm can legitimately + # want the shared services without being the host that controls them. + # + # Sits outside the `swarm` attrset above because it is a `deploy.*` + # option (./deploy.nix): "does THIS host run the controller" is exactly + # the per-host fact `swarm.*` may not carry. The ⚠️ collision note above + # does not apply here — that one is about two definitions of `swarm` + # itself, and this is a different top-level path. + config.services.hyperhive.deploy.swarm-controller.enable = lib.mkDefault cfg.enableAllLocalDefaults; }