vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: evaluate shared fixture configs once

Browse source 
Thirty-three module-eval fixtures were a second (or later) full
`nixosSystem` evaluation of a config another fixture already evaluated:
16 shapes defined identically in two to seven cluster files, plus
duplicates inside agent-queue-bao, core-toggle and
swarm-services-switch. Each cluster imports ./lib.nix itself, so nothing
was shared between them.

nix/module-eval/shared.nix now defines each of those 16 shapes once.
nix/checks.nix instantiates it a single time and passes it as `shared`
to the 23 clusters that read one, and each cluster rebinds the fixture
under its existing local name. Assertions are unchanged. Case text
changes only in core-toggle, where two cases built the forge-host
fixture inline and now read the file's `forgeHere`, and in two inline
`let` bindings (bao-otel-collector, grafana) that now take the shared
fixture.

Six folds are value-equal rather than textually equal: they drop an
explicit `deploy.hive-controller.enable = false` or
`deploy.swarm-otel.enable = false` that equals what the option already
resolves to for that config. Nothing under nix/host-modules sets either
option apart from the `mkDefault allSwarmServices` on swarm-otel, and
the only option-priority read there is `domain.highestPrio`.

Part of #5171.
This commit is contained in:
atlas 2026-10-13 00:55:01 +02:00 • committed by mara
commit 18ed3f5040
25 changed files with 201 additions and 147 deletions
Download patch file Download diff file Expand all files Collapse all files

21
nix/module-eval/secret-publisher.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -18,7 +19,6 @@ let
;
})
hive
hiveWithController
runGroup
;
@ -46,7 +46,7 @@ let
# The same IdP with the identity taken away. Minting the secrets is not being
# able to publish them, and this is the arm that separates the two.
secretPublisherNoIdentity = hive { deploy.authelia.enable = true; };
secretPublisherNoIdentity = shared.autheliaOnly;
# Duplicated from grafana.nix — a case here needs it too.
# The same UI with the IdP on ANOTHER host and a store leaf placed by hand.
@ -61,28 +61,17 @@ let
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
};
# Duplicated from swarm-otel-core.nix — a case here needs it too.
# The same collector with the IdP on ANOTHER host and a store leaf placed by
# hand. Identical to the fixture above in everything the delivery path
# reads, which is the point.
otelBaoRemoteAuthelia = hive {
deploy.swarm-otel.enable = true;
swarm.authelia.url = "https://auth.example.invalid";
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
};
# Duplicated from core-toggle.nix — a case here needs it too.
otelBaoRemoteAuthelia = shared.otelReaderMissingLeaf;
bare = hive { };
# Duplicated from bao-matrix-reader.nix — a case here needs it too.
inherit (shared) bare;
# The store and a service that reads from it, versus the store alone. The
# pair is what makes the reader's absence arm mean anything.
baoWithMatrix = hiveWithController {
deploy.bao.enable = true;
deploy.matrix.enable = true;
};
inherit (shared) baoWithMatrix;
cases = [
{
# Each hive's hive-c0re reads this exact path