vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: finish the "moved to" comment sweep

Browse source 
State where `enable` and the matrix name pins are now rather than where
they moved from: swarm-grafana-service, swarm-nats-service,
hive-matrix-service (and the bao-controller fixture comment quoting it),
plus the same-shaped history in agent-modules/otel, checks and
docs/default. Comments and option-description text only; no script
string changes. Refs #3902
This commit is contained in:
atlas 2026-10-05 03:19:09 +02:00
commit 16ccdb55fe
9 changed files with 26 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/agent-modules/otel.nix
View file

@ -56,11 +56,9 @@ let
# There is no auth header among them, and no mechanism to add one. An
# agent exports to the hive's own collector, which is the only thing
# holding a credential for anything upstream; nothing an agent can read
# is a secret to the swarm. An earlier revision forwarded the
# operator's upstream token into this container and merged it into the
# agent's own `~/.claude/settings.json` — which handed every agent the
# hive's credential, and was removed with the direct-export path it
# served.
# is a secret to the swarm. Forwarding the operator's upstream token into
# this container and merging it into the agent's own
# `~/.claude/settings.json` would hand every agent the hive's credential.
producerEnv = {
OTEL_EXPORTER_OTLP_ENDPOINT = cfg.endpoint;
OTEL_EXPORTER_OTLP_PROTOCOL = cfg.protocol;

4
nix/checks.nix
View file

@ -208,8 +208,8 @@ in
version = "0.1.0";
cargoTestExtraArgs = "--workspace";
HIVE_ASSETS_DIR = "${self.packages.${system}.assets}/share/hyperhive";
# The reserved-name blacklist moved out of the Rust tree and into
# `reserved-names.nix`, so the test that pins the message layer's
# The reserved-name blacklist lives in `reserved-names.nix`, not in the
# Rust tree, so the test that pins the message layer's
# sentinels against it can only run if nix hands it the same list the
# daemons get. Exported here and in `devshell.nix`, and the test PANICS
# rather than skipping when the variable is missing: a drift test that

13
nix/docs/default.nix
View file

@ -12,14 +12,11 @@
# subtree-pick / output-tree rationale: docs/process/gotchas.md::Nix options
# reference.
#
# `swarm.md`/`deploy.md` split off `host.md` (mara: "move swarm options
# to new docs page... deploy.* is also one of the things that should be
# a sub page"): `services.hyperhive.swarm.*` was mixed — swarm-wide
# facts (name, domain, hives, ca) alongside "does THIS host run it"
# toggles — until `deploy.nix` moved every such toggle to its own flat
# `services.hyperhive.deploy.*` namespace. That reorg landed first
# (see deploy.nix's file-top comment); this is the docs-side follow-up
# now that `swarm.*` genuinely is swarm-wide-only.
# `swarm.md`/`deploy.md` are separate pages from `host.md`:
# `services.hyperhive.swarm.*` holds swarm-wide facts (name, domain,
# hives, ca) only, and the "does THIS host run it" toggles live in the
# flat `services.hyperhive.deploy.*` namespace (see deploy.nix's file-top
# comment), so each namespace gets its own page.
let
# Content-addressed narrow source covering only the nix/ directory.
# `builtins.unsafeDiscardStringContext` strips `self`'s store-path

4
nix/host-modules/hive-forge/default.nix
View file

@ -938,8 +938,8 @@ in
# its token file deleted to force a re-mint with the new
# scope.
#
# Token name carries a timestamp suffix rather than the
# fixed `swarm-controller-boot` this used to be — a real
# Token name carries a timestamp suffix rather than a fixed
# `swarm-controller-boot` — a real
# incident, not a hypothetical: deleting the token *file*
# (the remediation above) doesn't delete the token Forgejo
# already has under that name, so re-running this unit hit

19
nix/host-modules/hive-matrix-service.nix
View file

@ -33,11 +33,10 @@ in
here only if you need a different server_name shape (e.g.
`chat.example.org` for a bespoke hostname).
**Breaking change, and the one on this page that cannot be
undone by rebuilding.** This default has now moved twice — from
`matrix.''${services.hyperhive.domain}`, then to the bare hive
domain, and now to the swarm domain. Every existing homeserver
must pin whichever value it already minted ids under, e.g.
**Changing this cannot be undone by rebuilding.** The default
is the swarm domain, so a homeserver that minted ids under
another value (`matrix.''${services.hyperhive.domain}` or the
bare hive domain) must pin that value, e.g.
```nix
services.hyperhive.swarm.matrix.serverName =
@ -121,13 +120,11 @@ in
through `.well-known`. `serverName` is the matrix-identifier
domain embedded **irrevocably** in every user and room id —
adopting a new one is a different homeserver, not a rename.
Both defaults now sit under the swarm domain, but only this
one is safe to move on a running deployment.
Both defaults sit under the swarm domain, but only this
one is safe to change on a running deployment.
A deployment that was running before this moved keeps its
current name by pinning
`matrix.''${services.hyperhive.domain}` here — exactly what the
old default rendered.
To use the per-hive name `matrix.''${services.hyperhive.domain}`
instead, pin it here.
'';
};

2
nix/host-modules/hive-tls.nix
View file

@ -131,7 +131,7 @@ let
# than a stale one — its own vhosts are covered by the hive leaf
# above. Anywhere else it is expected: the leaf comes from the
# secret store's `pki` mount now, not from a sub-CA that exists on
# one host in the swarm, so "this host cannot issue it" is no longer
# one host in the swarm, so "this host cannot issue it" is not
# one of the answers.
want_svc=${if localServiceDomains == [ ] then "0" else "1"}

2
nix/host-modules/swarm-grafana-service.nix
View file

@ -17,7 +17,7 @@ let
domainBase = if swarmDomain == null then "invalid" else swarmDomain;
in
{
# `enable` moved to `services.hyperhive.deploy.grafana.enable` — see
# `enable` is `services.hyperhive.deploy.grafana.enable` — see
# ./deploy.nix. Whether this host runs the swarm's Grafana is a
# deployment decision, and `swarm.*` has to be identical on every host.
# Here is what the service IS to every hive: the name it is served under,

4
nix/host-modules/swarm-nats-service.nix
View file

@ -13,13 +13,13 @@ let
in
{
options.services.hyperhive.swarm.nats = {
# `enable` moved to `services.hyperhive.deploy.nats.enable` — see
# `enable` is `services.hyperhive.deploy.nats.enable` — see
# ./deploy.nix. What the queue IS to every hive: its domain, ports
# and client id.
# ⚠️ Deliberately NO `package` option for the NATS server, anywhere —
# not here and not under `deploy.nats` either, where every other
# service's build now lives. `services.nats` upstream does not expose
# service's build lives. `services.nats` upstream does not expose
# one; it resolves `pkgs.nats-server` itself, so an option would be
# ignored or need an overlay to mean anything, and an option that does
# not control what it names is worse than its absence. Pin the build

4
nix/module-eval/bao-controller.nix
View file

@ -46,8 +46,8 @@ let
controllerNoStore = hive { deploy.swarm-controller.enable = true; };
# A deployment that pinned `gatewayHost` away from its own swarm-domain
# default (`hive-matrix-service.nix`'s own doc: "a deployment that was
# running before this moved keeps its current name by pinning ... here").
# default (`hive-matrix-service.nix`'s own doc: "To use the per-hive name
# ... instead, pin it here").
# Only this fixture can tell "the controller reads gatewayHost" apart from
# "the controller re-derives gatewayHost's default itself" — both render
# the same URL on every other fixture in this file.