vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

module-eval: pin authelia's rename and its repointed readers

Browse source 
Two arms with different jobs. `usersFile` is configured through its old
path, so dropping the rename entry fails the eval. `hostClientSecretDir`
cannot be configured at all — it is read-only and derived — so its arm
asserts that a consumer renders the derived path, which is what breaks
if a reader is left pointing at the namespace the option moved out of.

Seven of those reads went through an `autheliaCfg` alias rather than a
full path, where a path-shaped grep does not see them. That, not the
rename, was the failure this change could have shipped.

The two read-only options get no rename entry. A rename module
contributes a definition to its target and a read-only option refuses a
second one, so a shim for either makes every evaluation fail with "set
multiple times", naming the option's own declaration as the rival. Of
the 38 distinct leaves the rename table already targets, these are the
only two declared read-only.
This commit is contained in:
atlas 2026-09-07 15:20:37 +02:00 • committed by mara
commit 18de4b48c7
2 changed files with 41 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/host-modules/deploy.nix
View file

@ -97,14 +97,15 @@ in
[ "services" "hyperhive" "swarm" "authelia" "usersFile" ]
[ "services" "hyperhive" "deploy" "authelia" "usersFile" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "swarm" "authelia" "hostClientSecretDir" ]
[ "services" "hyperhive" "deploy" "authelia" "hostClientSecretDir" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "swarm" "authelia" "hostUsersFile" ]
[ "services" "hyperhive" "deploy" "authelia" "hostUsersFile" ]
)
# `hostClientSecretDir` and `hostUsersFile` moved in the same commit and
# deliberately have NO entry here. A rename module contributes a
# *definition* to its target, and both are `readOnly`, which refuses a
# second one — so a shim for either makes every evaluation fail with
# "set multiple times", naming the option's own default as the rival
# definition. Nothing could have set them anyway: both are derived and
# read-only, so the shim's only possible customer is a reader of the old
# path, and that reader now gets "option does not exist" instead, which
# says the same thing sooner.
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "swarm" "nats" "enable" ]
[ "services" "hyperhive" "deploy" "nats" "enable" ]