vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: evaluate shared fixture configs once

Browse source 
Thirty-three module-eval fixtures were a second (or later) full
`nixosSystem` evaluation of a config another fixture already evaluated:
16 shapes defined identically in two to seven cluster files, plus
duplicates inside agent-queue-bao, core-toggle and
swarm-services-switch. Each cluster imports ./lib.nix itself, so nothing
was shared between them.

nix/module-eval/shared.nix now defines each of those 16 shapes once.
nix/checks.nix instantiates it a single time and passes it as `shared`
to the 23 clusters that read one, and each cluster rebinds the fixture
under its existing local name. Assertions are unchanged. Case text
changes only in core-toggle, where two cases built the forge-host
fixture inline and now read the file's `forgeHere`, and in two inline
`let` bindings (bao-otel-collector, grafana) that now take the shared
fixture.

Six folds are value-equal rather than textually equal: they drop an
explicit `deploy.hive-controller.enable = false` or
`deploy.swarm-otel.enable = false` that equals what the option already
resolves to for that config. Nothing under nix/host-modules sets either
option apart from the `mkDefault allSwarmServices` on swarm-otel, and
the only option-priority read there is `domain.highestPrio`.

Part of #5171.
This commit is contained in:
atlas 2026-10-13 00:55:01 +02:00 • committed by mara
commit 18ed3f5040
25 changed files with 201 additions and 147 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/module-eval/bao-otel-collector.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -36,14 +37,7 @@ let
# The store with and without a collector on the same host. `scrapeTargets`
# is only ever read by a local collector, so the metrics endpoint is a
# function of the pairing rather than of the store.
baoWithCollector = hive {
deploy.bao.enable = true;
deploy.swarm-otel.enable = true;
# A second job declared as bare `host:port`, so the pair of cases below
# reads one rendered scrape list: the store's entry carries a path, this
# one carries none.
swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
};
inherit (shared) baoWithCollector;
# The SPLIT topology, and the reason it is not called `baoNoCollector` any
# more: a swarm always runs every swarm-level service somewhere, so this host
@ -51,21 +45,12 @@ let
# host, never that the swarm has none. Both of those read the same locally,
# and only one of them is a real deployment — which is what the two gates
# this PR removed each mistook for "there is nothing to forward to".
baoOtelElsewhere = hive {
deploy.bao.enable = true;
deploy.swarm-otel.enable = false;
};
baoOtelElsewhere = shared.baoOnly;
# The same split, plus a HIVE collector on the store's host — the pairing the
# first gate read as permission to forward. It is a third collector with a
# different job, so it changes neither whether the store forwards nor where.
# `clientSecretFile` is what ../host-modules/otel.nix's identity assertion
# demands of any hive with the tier on.
baoWithHiveOtel = hive {
deploy.bao.enable = true;
otel.enable = true;
otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
};
inherit (shared) baoWithHiveOtel;
# The forwarder INSIDE the store's container, not the host's collector and
# not the swarm tier's — three collectors in this tree, and only this one can
@ -444,7 +429,7 @@ let
name = "the forwarder's client is registered wherever authelia runs";
ok =
let
autheliaOnly = hive { deploy.authelia.enable = true; };
inherit (shared) autheliaOnly;
clients = autheliaOnly.services.hyperhive.swarm.authelia.oidc.clients;
c = lib.findFirst (c: c.id == "swarm-bao-collector") null clients;
in