From 16ccdb55fe45f7fb1c64d7e620a0db36c526568f Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 5 Oct 2026 03:19:09 +0200 Subject: [PATCH] nix: finish the "moved to" comment sweep State where `enable` and the matrix name pins are now rather than where they moved from: swarm-grafana-service, swarm-nats-service, hive-matrix-service (and the bao-controller fixture comment quoting it), plus the same-shaped history in agent-modules/otel, checks and docs/default. Comments and option-description text only; no script string changes. Refs #3902 --- nix/agent-modules/otel.nix | 8 +++----- nix/checks.nix | 4 ++-- nix/docs/default.nix | 13 +++++-------- nix/host-modules/hive-forge/default.nix | 4 ++-- nix/host-modules/hive-matrix-service.nix | 19 ++++++++----------- nix/host-modules/hive-tls.nix | 2 +- nix/host-modules/swarm-grafana-service.nix | 2 +- nix/host-modules/swarm-nats-service.nix | 4 ++-- nix/module-eval/bao-controller.nix | 4 ++-- 9 files changed, 26 insertions(+), 34 deletions(-) diff --git a/nix/agent-modules/otel.nix b/nix/agent-modules/otel.nix index 550eacb9..359fe81d 100644 --- a/nix/agent-modules/otel.nix +++ b/nix/agent-modules/otel.nix @@ -56,11 +56,9 @@ let # There is no auth header among them, and no mechanism to add one. An # agent exports to the hive's own collector, which is the only thing # holding a credential for anything upstream; nothing an agent can read - # is a secret to the swarm. An earlier revision forwarded the - # operator's upstream token into this container and merged it into the - # agent's own `~/.claude/settings.json` — which handed every agent the - # hive's credential, and was removed with the direct-export path it - # served. + # is a secret to the swarm. Forwarding the operator's upstream token into + # this container and merging it into the agent's own + # `~/.claude/settings.json` would hand every agent the hive's credential. producerEnv = { OTEL_EXPORTER_OTLP_ENDPOINT = cfg.endpoint; OTEL_EXPORTER_OTLP_PROTOCOL = cfg.protocol; diff --git a/nix/checks.nix b/nix/checks.nix index eedc7bc4..d9bf8011 100644 --- a/nix/checks.nix +++ b/nix/checks.nix @@ -208,8 +208,8 @@ in version = "0.1.0"; cargoTestExtraArgs = "--workspace"; HIVE_ASSETS_DIR = "${self.packages.${system}.assets}/share/hyperhive"; - # The reserved-name blacklist moved out of the Rust tree and into - # `reserved-names.nix`, so the test that pins the message layer's + # The reserved-name blacklist lives in `reserved-names.nix`, not in the + # Rust tree, so the test that pins the message layer's # sentinels against it can only run if nix hands it the same list the # daemons get. Exported here and in `devshell.nix`, and the test PANICS # rather than skipping when the variable is missing: a drift test that diff --git a/nix/docs/default.nix b/nix/docs/default.nix index 2c76c719..47f15315 100644 --- a/nix/docs/default.nix +++ b/nix/docs/default.nix @@ -12,14 +12,11 @@ # subtree-pick / output-tree rationale: docs/process/gotchas.md::Nix options # reference. # -# `swarm.md`/`deploy.md` split off `host.md` (mara: "move swarm options -# to new docs page... deploy.* is also one of the things that should be -# a sub page"): `services.hyperhive.swarm.*` was mixed — swarm-wide -# facts (name, domain, hives, ca) alongside "does THIS host run it" -# toggles — until `deploy.nix` moved every such toggle to its own flat -# `services.hyperhive.deploy.*` namespace. That reorg landed first -# (see deploy.nix's file-top comment); this is the docs-side follow-up -# now that `swarm.*` genuinely is swarm-wide-only. +# `swarm.md`/`deploy.md` are separate pages from `host.md`: +# `services.hyperhive.swarm.*` holds swarm-wide facts (name, domain, +# hives, ca) only, and the "does THIS host run it" toggles live in the +# flat `services.hyperhive.deploy.*` namespace (see deploy.nix's file-top +# comment), so each namespace gets its own page. let # Content-addressed narrow source covering only the nix/ directory. # `builtins.unsafeDiscardStringContext` strips `self`'s store-path diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index b4ee8458..728bcfcd 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -938,8 +938,8 @@ in # its token file deleted to force a re-mint with the new # scope. # - # Token name carries a timestamp suffix rather than the - # fixed `swarm-controller-boot` this used to be — a real + # Token name carries a timestamp suffix rather than a fixed + # `swarm-controller-boot` — a real # incident, not a hypothetical: deleting the token *file* # (the remediation above) doesn't delete the token Forgejo # already has under that name, so re-running this unit hit diff --git a/nix/host-modules/hive-matrix-service.nix b/nix/host-modules/hive-matrix-service.nix index 2c3d576e..f2a780c3 100644 --- a/nix/host-modules/hive-matrix-service.nix +++ b/nix/host-modules/hive-matrix-service.nix @@ -33,11 +33,10 @@ in here only if you need a different server_name shape (e.g. `chat.example.org` for a bespoke hostname). - **Breaking change, and the one on this page that cannot be - undone by rebuilding.** This default has now moved twice — from - `matrix.''${services.hyperhive.domain}`, then to the bare hive - domain, and now to the swarm domain. Every existing homeserver - must pin whichever value it already minted ids under, e.g. + **Changing this cannot be undone by rebuilding.** The default + is the swarm domain, so a homeserver that minted ids under + another value (`matrix.''${services.hyperhive.domain}` or the + bare hive domain) must pin that value, e.g. ```nix services.hyperhive.swarm.matrix.serverName = @@ -121,13 +120,11 @@ in through `.well-known`. `serverName` is the matrix-identifier domain embedded **irrevocably** in every user and room id — adopting a new one is a different homeserver, not a rename. - Both defaults now sit under the swarm domain, but only this - one is safe to move on a running deployment. + Both defaults sit under the swarm domain, but only this + one is safe to change on a running deployment. - A deployment that was running before this moved keeps its - current name by pinning - `matrix.''${services.hyperhive.domain}` here — exactly what the - old default rendered. + To use the per-hive name `matrix.''${services.hyperhive.domain}` + instead, pin it here. ''; }; diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix index 49ee6d65..8519b03e 100644 --- a/nix/host-modules/hive-tls.nix +++ b/nix/host-modules/hive-tls.nix @@ -131,7 +131,7 @@ let # than a stale one — its own vhosts are covered by the hive leaf # above. Anywhere else it is expected: the leaf comes from the # secret store's `pki` mount now, not from a sub-CA that exists on - # one host in the swarm, so "this host cannot issue it" is no longer + # one host in the swarm, so "this host cannot issue it" is not # one of the answers. want_svc=${if localServiceDomains == [ ] then "0" else "1"} diff --git a/nix/host-modules/swarm-grafana-service.nix b/nix/host-modules/swarm-grafana-service.nix index c302f231..15e95047 100644 --- a/nix/host-modules/swarm-grafana-service.nix +++ b/nix/host-modules/swarm-grafana-service.nix @@ -17,7 +17,7 @@ let domainBase = if swarmDomain == null then "invalid" else swarmDomain; in { - # `enable` moved to `services.hyperhive.deploy.grafana.enable` — see + # `enable` is `services.hyperhive.deploy.grafana.enable` — see # ./deploy.nix. Whether this host runs the swarm's Grafana is a # deployment decision, and `swarm.*` has to be identical on every host. # Here is what the service IS to every hive: the name it is served under, diff --git a/nix/host-modules/swarm-nats-service.nix b/nix/host-modules/swarm-nats-service.nix index 506399c6..56ec72cf 100644 --- a/nix/host-modules/swarm-nats-service.nix +++ b/nix/host-modules/swarm-nats-service.nix @@ -13,13 +13,13 @@ let in { options.services.hyperhive.swarm.nats = { - # `enable` moved to `services.hyperhive.deploy.nats.enable` — see + # `enable` is `services.hyperhive.deploy.nats.enable` — see # ./deploy.nix. What the queue IS to every hive: its domain, ports # and client id. # ⚠️ Deliberately NO `package` option for the NATS server, anywhere — # not here and not under `deploy.nats` either, where every other - # service's build now lives. `services.nats` upstream does not expose + # service's build lives. `services.nats` upstream does not expose # one; it resolves `pkgs.nats-server` itself, so an option would be # ignored or need an overlay to mean anything, and an option that does # not control what it names is worse than its absence. Pin the build diff --git a/nix/module-eval/bao-controller.nix b/nix/module-eval/bao-controller.nix index 8abbb888..8f7d6bc9 100644 --- a/nix/module-eval/bao-controller.nix +++ b/nix/module-eval/bao-controller.nix @@ -46,8 +46,8 @@ let controllerNoStore = hive { deploy.swarm-controller.enable = true; }; # A deployment that pinned `gatewayHost` away from its own swarm-domain - # default (`hive-matrix-service.nix`'s own doc: "a deployment that was - # running before this moved keeps its current name by pinning ... here"). + # default (`hive-matrix-service.nix`'s own doc: "To use the per-hive name + # ... instead, pin it here"). # Only this fixture can tell "the controller reads gatewayHost" apart from # "the controller re-derives gatewayHost's default itself" — both render # the same URL on every other fixture in this file.