vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: evaluate shared fixture configs once

Browse source 
Thirty-three module-eval fixtures were a second (or later) full
`nixosSystem` evaluation of a config another fixture already evaluated:
16 shapes defined identically in two to seven cluster files, plus
duplicates inside agent-queue-bao, core-toggle and
swarm-services-switch. Each cluster imports ./lib.nix itself, so nothing
was shared between them.

nix/module-eval/shared.nix now defines each of those 16 shapes once.
nix/checks.nix instantiates it a single time and passes it as `shared`
to the 23 clusters that read one, and each cluster rebinds the fixture
under its existing local name. Assertions are unchanged. Case text
changes only in core-toggle, where two cases built the forge-host
fixture inline and now read the file's `forgeHere`, and in two inline
`let` bindings (bao-otel-collector, grafana) that now take the shared
fixture.

Six folds are value-equal rather than textually equal: they drop an
explicit `deploy.hive-controller.enable = false` or
`deploy.swarm-otel.enable = false` that equals what the option already
resolves to for that config. Nothing under nix/host-modules sets either
option apart from the `mkDefault allSwarmServices` on swarm-otel, and
the only option-priority read there is `domain.highestPrio`.

Part of #5171.
This commit is contained in:
atlas 2026-10-13 00:55:01 +02:00 • committed by mara
commit 18ed3f5040
25 changed files with 201 additions and 147 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/checks.nix
View file

@ -12,6 +12,13 @@
}:
let
inherit (rust) cleanSrc cargoArtifacts nativeBuildInputs;
# Bound here, once, so every cluster handed it reads the same evaluation of
# each fixture; see ./module-eval/shared.nix.
moduleEvalShared = import ./module-eval/shared.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
};
in
{
formatting = treefmt-eval.config.build.check self;
@ -30,14 +37,17 @@ in
module-eval-core-toggle = import ./module-eval/core-toggle.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-swarm-services-switch = import ./module-eval/swarm-services-switch.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-nats-authelia = import ./module-eval/nats-authelia.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
# Executes the queue server's config render, which `module-eval-nats-authelia`
# only sees as a store path: the callout xkey it writes is a build output.
@ -48,58 +58,72 @@ in
module-eval-nats-tls = import ./module-eval/nats-tls.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-hive-tls = import ./module-eval/hive-tls.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-matrix-core = import ./module-eval/matrix-core.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-grafana = import ./module-eval/grafana.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-forge-placement = import ./module-eval/forge-placement.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-bao-basics = import ./module-eval/bao-basics.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-bao-matrix-reader = import ./module-eval/bao-matrix-reader.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-bao-grants = import ./module-eval/bao-grants.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-bao-controller = import ./module-eval/bao-controller.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-secret-publisher = import ./module-eval/secret-publisher.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-bao-otel-collector = import ./module-eval/bao-otel-collector.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-swarm-otel-core = import ./module-eval/swarm-otel-core.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-swarm-otel-identity = import ./module-eval/swarm-otel-identity.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-hive-otel = import ./module-eval/hive-otel.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-name-guards = import ./module-eval/name-guards.nix {
inherit pkgs self nixosSystem;
@ -108,6 +132,7 @@ in
module-eval-agent-otel = import ./module-eval/agent-otel.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
# Not a subsystem cluster like its siblings but a single shared file, and
# its own derivation for that reason: both journald receivers import one
@ -121,6 +146,7 @@ in
module-eval-agent-queue-bao = import ./module-eval/agent-queue-bao.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-agent-forge-bao = import ./module-eval/agent-forge-bao.nix {
inherit pkgs self nixosSystem;
@ -147,14 +173,17 @@ in
module-eval-agent-github-bao = import ./module-eval/agent-github-bao.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-agent-memory = import ./module-eval/agent-memory.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-agent-plugins = import ./module-eval/agent-plugins.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
module-eval-agent-runtime = import ./module-eval/agent-runtime.nix {
inherit pkgs self nixosSystem;
@ -171,6 +200,7 @@ in
module-eval-agent-matrix = import ./module-eval/agent-matrix.nix {
inherit pkgs self nixosSystem;
inherit (pkgs) lib;
shared = moduleEvalShared;
};
# Clippy via crane's first-class `cargoClippy` builder. Reuses the

7
nix/module-eval/agent-github-bao.nix
View file

@ -9,6 +9,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -27,12 +28,10 @@ let
baoAddr = "https://bao.t.local:8200";
# A store, and the integration on by default.
agentGithubBao = agentWith {
services.hyperhive.agent.bao.addr = baoAddr;
};
agentGithubBao = shared.agentWithBao;
# No store: the absence arm, and what makes the cases above able to fail.
agentGithubNoBao = agentWith { };
agentGithubNoBao = shared.agentBare;
# A store, and the integration switched off.
agentGithubOff = agentWith {

3
nix/module-eval/agent-matrix.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -37,7 +38,7 @@ let
# matrix on with no `main` at all.
agentMatrix = agent { matrix.url = "https://chat.t.local"; };
agentNoMatrix = agent { };
agentNoMatrix = shared.agentBare;
agentMatrixExternalOnly = agent {
matrixAccounts.ccc = {

4
nix/module-eval/agent-memory.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -17,12 +18,11 @@ let
nixosSystem
;
})
agent
runGroup
agentHarness
;
agentDefault = agent { };
agentDefault = shared.agentBare;
agentBashDaemon = machine: machine.systemd.services.hive-bash-daemon;
agentSubagentDaemon = machine: machine.systemd.services.hive-subagent-daemon;

3
nix/module-eval/agent-otel.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -44,7 +45,7 @@ let
otel.protocol = "grpc";
};
agentNoOtel = agent { };
agentNoOtel = shared.agentBare;
agentSettings = machine: machine.services.opentelemetry-collector.settings;
cases = [

3
nix/module-eval/agent-plugins.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -27,7 +28,7 @@ let
# outright — the two arms below plus the unset default (read directly off
# `bare`-shaped `agent { }`, no fixture of its own needed) are the three
# cases that shape has to hold.
agentPluginsDefault = agent { };
agentPluginsDefault = shared.agentBare;
agentPluginsAdded = agent { claudePlugins = [ "foo@bar" ]; };

8
nix/module-eval/agent-queue-bao.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -18,7 +19,6 @@ let
;
})
agent
agentWith
runGroup
agentHarness
;
@ -31,14 +31,14 @@ let
queue.tokenEndpoint = "https://auth.t.local/api/oidc/token";
};
agentNoQueue = agent { };
agentNoQueue = shared.agentBare;
# The agent side of the swarm secret store. The address is the whole switch —
# it is both what generates the login check and what that check points at —
# so it and the empty fixture beside it are the two arms worth having.
agentBao = agentWith { services.hyperhive.agent.bao.addr = "https://bao.t.local:8200"; };
agentBao = shared.agentWithBao;
agentNoBao = agentWith { };
agentNoBao = shared.agentBare;
agentBaoIdentity = machine: machine.systemd.services.hive-agent-bao-identity;
cases = [

3
nix/module-eval/bao-basics.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -41,7 +42,7 @@ let
deploy.bao.serverKeyFile = "/etc/pki/bao-key.pem";
};
autheliaOnly = hive { deploy.authelia.enable = true; };
inherit (shared) autheliaOnly;
baoWithForge = hive {
deploy.bao.enable = true;

3
nix/module-eval/bao-controller.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -43,7 +44,7 @@ let
# The controller with no store, which is every spread deployment. Nothing
# mints here, so the pairing must leave the paths unset rather than name
# files this host will never have.
controllerNoStore = hive { deploy.swarm-controller.enable = true; };
controllerNoStore = shared.controllerAlone;
# A deployment that pinned `gatewayHost` away from its own swarm-domain
# default (`hive-matrix-service.nix`'s own doc: "To use the per-hive name

5
nix/module-eval/bao-grants.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -39,9 +40,7 @@ let
# The store with no bootstrap token: the steady state once the granter is set
# up, and the state of a store host that has never named one.
baoGranterNoToken = hive {
deploy.bao.enable = true;
};
baoGranterNoToken = shared.baoOnly;
# The store with the granter's pair taken away: the deployment that writes
# its grants some other way.

8
nix/module-eval/bao-matrix-reader.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -24,10 +25,7 @@ let
# The store and a service that reads from it, versus the store alone. The
# pair is what makes the reader's absence arm mean anything.
baoWithMatrix = hiveWithController {
deploy.bao.enable = true;
deploy.matrix.enable = true;
};
inherit (shared) baoWithMatrix;
# A hive that reads from a store it does not run: no `deploy.bao.enable`, so
# nothing here mints a leaf and the operator names one placed by hand. The
@ -51,7 +49,7 @@ let
# store nor a hand-placed leaf. The absence arm for the matrix-ctl cases below
# needs it, and defining it here rather than importing keeps each group's
# fixture set its own, as ./lib.nix asks.
matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };
inherit (shared) matrixNoBaoIdentity;
# 🩸 The hand-configured remote reader that named the hive's leaf and stopped.
# `baoRemoteReader` above is the same deployment done right; this one holds

25
nix/module-eval/bao-otel-collector.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -36,14 +37,7 @@ let
# The store with and without a collector on the same host. `scrapeTargets`
# is only ever read by a local collector, so the metrics endpoint is a
# function of the pairing rather than of the store.
baoWithCollector = hive {
deploy.bao.enable = true;
deploy.swarm-otel.enable = true;
# A second job declared as bare `host:port`, so the pair of cases below
# reads one rendered scrape list: the store's entry carries a path, this
# one carries none.
swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
};
inherit (shared) baoWithCollector;
# The SPLIT topology, and the reason it is not called `baoNoCollector` any
# more: a swarm always runs every swarm-level service somewhere, so this host
@ -51,21 +45,12 @@ let
# host, never that the swarm has none. Both of those read the same locally,
# and only one of them is a real deployment — which is what the two gates
# this PR removed each mistook for "there is nothing to forward to".
baoOtelElsewhere = hive {
deploy.bao.enable = true;
deploy.swarm-otel.enable = false;
};
baoOtelElsewhere = shared.baoOnly;
# The same split, plus a HIVE collector on the store's host — the pairing the
# first gate read as permission to forward. It is a third collector with a
# different job, so it changes neither whether the store forwards nor where.
# `clientSecretFile` is what ../host-modules/otel.nix's identity assertion
# demands of any hive with the tier on.
baoWithHiveOtel = hive {
deploy.bao.enable = true;
otel.enable = true;
otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
};
inherit (shared) baoWithHiveOtel;
# The forwarder INSIDE the store's container, not the host's collector and
# not the swarm tier's — three collectors in this tree, and only this one can
@ -444,7 +429,7 @@ let
name = "the forwarder's client is registered wherever authelia runs";
ok =
let
autheliaOnly = hive { deploy.authelia.enable = true; };
inherit (shared) autheliaOnly;
clients = autheliaOnly.services.hyperhive.swarm.authelia.oidc.clients;
c = lib.findFirst (c: c.id == "swarm-bao-collector") null clients;
in

23
nix/module-eval/core-toggle.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -27,9 +28,9 @@ let
swarmServiceEnables
;
allLocal = hiveWithController { deploy.singleHostSwarm = true; };
inherit (shared) allLocal;
bare = hiveWithController { };
bare = shared.bareWithController;
# The same stub with the central toggle (`deploy.hive-controller.enable`)
# off. Paired with `bare` below to pin the defaults that do not read it:
@ -41,7 +42,9 @@ let
# nothing on" host the swarm-service absences below read: none of the
# per-service deployment toggles derives from the hive being on, so it
# renders the same absences `bare` does.
centralToggleOff = hive { deploy.hive-controller.enable = false; };
centralToggleOff = shared.bare;
inherit (shared) forgeHere;
# Every hive defaults the agents' queue address to the queue's name, so the
# only hive without one is a hive told to have none.
@ -123,12 +126,7 @@ let
# (./forge-placement.nix), never the central toggle: a forge host with
# the toggle off still publishes it.
name = "the forge's controller-token publisher does not consult the central toggle";
ok =
(hive {
deploy.hive-controller.enable = false;
deploy.forgejo.enable = true;
}).systemd.services
? swarm-bao-forge-publisher;
ok = forgeHere.systemd.services ? swarm-bao-forge-publisher;
}
{
name = "a hive that does not host the swarm's shared services runs none of them";
@ -233,7 +231,6 @@ let
name = "a gateway's services leaf asks for only the swarm names that host fronts";
ok =
let
forgeHere = hive { deploy.forgejo.enable = true; };
s = forgeHere.services.hyperhive.swarm.serviceDomains;
u = forgeHere.systemd.services.swarm-services-cert.script;
in
@ -251,11 +248,7 @@ let
let
s = h: h.services.hyperhive.swarm.serviceDomains;
in
s (hive {
deploy.forgejo.enable = true;
}) == s bare
&& s allLocal == s bare
&& lib.elem "grafana.t.local" (s bare);
s forgeHere == s bare && s allLocal == s bare && lib.elem "grafana.t.local" (s bare);
}
{
# The narrowing's floor: no names left means no request, rather than a

6
nix/module-eval/forge-placement.nix
View file

@ -11,6 +11,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -26,10 +27,9 @@ let
runGroup
;
bare = hive { };
inherit (shared) bare;
allLocal = hive { deploy.singleHostSwarm = true; };
servicesHere = hive { deploy.allSwarmServices = true; };
forgeHere = hive { deploy.forgejo.enable = true; };
inherit (shared) servicesHere forgeHere;
# The shared services here, the forge somewhere else. Every derivation in
# ../host-modules/swarm-required-services.nix is `mkDefault`, so this stays

3
nix/module-eval/grafana.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -247,7 +248,7 @@ let
name = "hive identities and the token endpoint do not depend on which host runs what";
ok =
let
autheliaNoQueue = hive { deploy.authelia.enable = true; };
autheliaNoQueue = shared.autheliaOnly;
in
lib.elem "hive-h1" (map (c: c.id) autheliaNoQueue.services.hyperhive.swarm.authelia.oidc.clients)
&&

26
nix/module-eval/hive-otel.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -59,31 +60,16 @@ let
lib.findFirst (
c: c.job_name == job
) null hiveOtelSettings.receivers.prometheus.config.scrape_configs;
# Duplicated from bao-otel-collector.nix — a case here needs it too.
# The store with and without a collector on the same host. `scrapeTargets`
# is only ever read by a local collector, so the metrics endpoint is a
# function of the pairing rather than of the store.
baoWithCollector = hive {
deploy.bao.enable = true;
deploy.swarm-otel.enable = true;
# A second job declared as bare `host:port`, so the pair of cases below
# reads one rendered scrape list: the store's entry carries a path, this
# one carries none.
swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
};
inherit (shared) baoWithCollector;
# Also duplicated from bao-otel-collector.nix, where it is the fixture for
# the store standing beside a HIVE collector. That co-location is exactly
# the topology the port case below needs: two collectors, one netns, and
# nothing but their self-telemetry ports keeping them apart.
# `clientSecretFile` is what ../host-modules/otel.nix's identity assertion
# demands of any hive with the tier on.
baoWithHiveOtel = hive {
deploy.bao.enable = true;
otel.enable = true;
otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
};
# The store standing beside a HIVE collector: the topology the port case
# below needs, two collectors in one netns with nothing but their
# self-telemetry ports keeping them apart.
inherit (shared) baoWithHiveOtel;
# The collector INSIDE the store's container — neither the host's nor the
# swarm tier's.

7
nix/module-eval/hive-tls.nix
View file

@ -11,6 +11,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -29,9 +30,7 @@ let
# Every service on one host, so the store's granting unit renders the role
# this leaf is issued through.
allLocal = hiveWithController {
deploy.singleHostSwarm = true;
};
inherit (shared) allLocal;
# The same host with the role's lifetime moved, so a threshold that is a
# number of its own shows up as one that did not move with it.
@ -66,7 +65,7 @@ let
noPairFetch = noServiceNoPair.systemd.services.swarm-services-cert.script;
# The same hive with no store identity at all.
noIdentity = hiveWithController { };
noIdentity = shared.bareWithController;
noIdFetch = noIdentity.systemd.services.swarm-services-cert.script;
# A gateway on a host with no hive and no store, fronting no swarm name,

6
nix/module-eval/matrix-core.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -18,7 +19,6 @@ let
;
})
hive
hiveWithController
runGroup
;
@ -31,11 +31,11 @@ let
# The same hive with the identity taken away, which separates "a homeserver
# is deployed" from "this host can authenticate to the store".
matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };
inherit (shared) matrixNoBaoIdentity;
# A hive host that does not run the homeserver: its hive-c0re reaches the
# homeserver across the network.
matrixElsewhere = hiveWithController { };
matrixElsewhere = shared.bareWithController;
cases = [
{
# Absence arm, and what makes the one above able to fail: with no leaf

5
nix/module-eval/nats-authelia.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -93,9 +94,9 @@ let
# `swarm.authelia.url` set by hand. The whole point of the fixture is what it
# does *not* say: no IdP address is given and none is derived from
# co-location.
autheliaNotColocated = hive { };
autheliaNotColocated = shared.bare;
# The same swarm's IdP host, for the arm that the two agree.
autheliaColocated = hive { deploy.authelia.enable = true; };
autheliaColocated = shared.autheliaOnly;
cases = [
{

5
nix/module-eval/nats-tls.nix
View file

@ -7,6 +7,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -29,9 +30,7 @@ let
# Every service on one host. The queue, the store and every in-tree client of the queue
# are all here, so the scan below reads each of them.
allLocal = hiveWithController {
deploy.singleHostSwarm = true;
};
inherit (shared) allLocal;
# The same host on the mesh.
allLocalMesh = hive {

21
nix/module-eval/secret-publisher.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -18,7 +19,6 @@ let
;
})
hive
hiveWithController
runGroup
;
@ -46,7 +46,7 @@ let
# The same IdP with the identity taken away. Minting the secrets is not being
# able to publish them, and this is the arm that separates the two.
secretPublisherNoIdentity = hive { deploy.authelia.enable = true; };
secretPublisherNoIdentity = shared.autheliaOnly;
# Duplicated from grafana.nix — a case here needs it too.
# The same UI with the IdP on ANOTHER host and a store leaf placed by hand.
@ -61,28 +61,17 @@ let
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
};
# Duplicated from swarm-otel-core.nix — a case here needs it too.
# The same collector with the IdP on ANOTHER host and a store leaf placed by
# hand. Identical to the fixture above in everything the delivery path
# reads, which is the point.
otelBaoRemoteAuthelia = hive {
deploy.swarm-otel.enable = true;
swarm.authelia.url = "https://auth.example.invalid";
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
};
# Duplicated from core-toggle.nix — a case here needs it too.
otelBaoRemoteAuthelia = shared.otelReaderMissingLeaf;
bare = hive { };
# Duplicated from bao-matrix-reader.nix — a case here needs it too.
inherit (shared) bare;
# The store and a service that reads from it, versus the store alone. The
# pair is what makes the reader's absence arm mean anything.
baoWithMatrix = hiveWithController {
deploy.bao.enable = true;
deploy.matrix.enable = true;
};
inherit (shared) baoWithMatrix;
cases = [
{
# Each hive's hive-c0re reads this exact path

96
nix/module-eval/shared.nix Normal file
View file

@ -0,0 +1,96 @@
# The fixtures more than one `checks.module-eval-*` cluster reads, each
# evaluated once. ../checks.nix imports this file once and hands the result to
# every cluster that uses one; a cluster rebinds the fixture under its own
# local name.
#
# ⚠️ Sharing only pays when ../checks.nix instantiates this file ONCE: a
# cluster that ran `import ./shared.nix` itself would get its own copy of
# every fixture, the same as defining them locally. The cost is that each
# fixture here stays live for the whole evaluation rather than one cluster's.
#
# Holds only configs that are identical across their users. A cluster whose
# claim needs one more option set defines its own fixture.
{
pkgs,
lib,
self,
nixosSystem,
}:
let
inherit
(import ./lib.nix {
inherit
pkgs
lib
self
nixosSystem
;
})
hive
hiveWithController
agent
agentWith
;
in
{
agentBare = agent { };
agentWithBao = agentWith { services.hyperhive.agent.bao.addr = "https://bao.t.local:8200"; };
bare = hive { };
bareWithController = hiveWithController { };
allLocal = hiveWithController { deploy.singleHostSwarm = true; };
autheliaOnly = hive { deploy.authelia.enable = true; };
forgeHere = hive { deploy.forgejo.enable = true; };
baoOnly = hive { deploy.bao.enable = true; };
servicesHere = hive { deploy.allSwarmServices = true; };
controllerAlone = hive { deploy.swarm-controller.enable = true; };
matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };
baoWithMatrix = hiveWithController {
deploy.bao.enable = true;
deploy.matrix.enable = true;
};
# A second job declared as bare `host:port`, so a case can read one rendered
# scrape list where the store's entry carries a path and this one carries
# none.
baoWithCollector = hive {
deploy.bao.enable = true;
deploy.swarm-otel.enable = true;
swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
};
# `clientSecretFile` is what ../host-modules/otel.nix's identity assertion
# demands of any hive with the tier on.
baoWithHiveOtel = hive {
deploy.bao.enable = true;
otel.enable = true;
otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
};
# The swarm collector with the IdP on another host and the store leaf placed
# by hand, without and with the collector's own OIDC pair.
otelReaderMissingLeaf = hive {
deploy.swarm-otel.enable = true;
swarm.authelia.url = "https://auth.example.invalid";
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
};
otelReaderNamedInFull = hive {
deploy.swarm-otel.enable = true;
swarm.authelia.url = "https://auth.example.invalid";
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
deploy.bao.otelOidcClientCertFile = "/etc/pki/bao-otel-oidc.pem";
deploy.bao.otelOidcClientKeyFile = "/etc/pki/bao-otel-oidc-key.pem";
};
}

10
nix/module-eval/swarm-otel-core.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -53,14 +54,7 @@ let
# The same collector with the IdP on ANOTHER host and a store leaf placed by
# hand. Identical to the fixture above in everything the delivery path
# reads, which is the point.
otelBaoRemoteAuthelia = hive {
deploy.swarm-otel.enable = true;
swarm.authelia.url = "https://auth.example.invalid";
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
deploy.bao.otelOidcClientCertFile = "/etc/pki/bao-otel-oidc.pem";
deploy.bao.otelOidcClientKeyFile = "/etc/pki/bao-otel-oidc-key.pem";
};
otelBaoRemoteAuthelia = shared.otelReaderNamedInFull;
cases = [
{

17
nix/module-eval/swarm-otel-identity.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -41,24 +42,12 @@ let
# regression rather than the supported degrade `otelNoIdentity` stands for. The
# two fixtures differ in exactly that one pair, which is what lets the arms
# below separate a refusal from a degrade.
otelReaderMissingLeaf = hive {
deploy.swarm-otel.enable = true;
swarm.authelia.url = "https://auth.example.invalid";
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
};
inherit (shared) otelReaderMissingLeaf;
# The same deployment named in full, which must stay buildable. Pairs with the
# fixture above so the refusal is pinned to the omission and not to reading a
# remote store at all.
otelReaderNamedInFull = hive {
deploy.swarm-otel.enable = true;
swarm.authelia.url = "https://auth.example.invalid";
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
deploy.bao.otelOidcClientCertFile = "/etc/pki/bao-otel-oidc.pem";
deploy.bao.otelOidcClientKeyFile = "/etc/pki/bao-otel-oidc-key.pem";
};
inherit (shared) otelReaderNamedInFull;
# Did the module refuse this host, and over which option. An assertion is a
# config VALUE until something forces it — `.config` never throws — so a

21
nix/module-eval/swarm-services-switch.nix
View file

@ -6,6 +6,7 @@
lib,
self,
nixosSystem,
shared,
}:
let
inherit
@ -26,25 +27,15 @@ let
# A dedicated services host with hives elsewhere: the swarm-services
# toggle and no hive, the recipe docs/swarm/services.md gives.
swarmServicesOnly = hive {
deploy.hive-controller.enable = false;
deploy.allSwarmServices = true;
};
swarmServicesOnly = shared.servicesHere;
# A services host with hives elsewhere and the store elsewhere too: no hive
# and no store identity minted here.
swarmServicesOnlyNoStore = hive {
deploy.hive-controller.enable = false;
deploy.allSwarmServices = true;
deploy.bao.enable = false;
};
swarmServicesOnlyNoStore = swarmServicesBaoElsewhere;
# A dedicated secret-store host: no hive, and the store's browser UI the
# only swarm name its gateway fronts.
storeOnlyNoHive = hive {
deploy.hive-controller.enable = false;
deploy.bao.enable = true;
};
storeOnlyNoHive = shared.baoOnly;
# The homeserver on a host without a hive.
matrixNoHive = hive {
@ -123,7 +114,7 @@ let
deploy.forgejo.enable = true;
deploy.forgejo.mirrors = [ aMirror ];
};
forgeOnly = hive { deploy.forgejo.enable = true; };
forgeOnly = shared.forgeHere;
forgeWithController = hive {
deploy.swarm-controller.enable = true;
deploy.forgejo.enable = true;
@ -138,7 +129,7 @@ let
# The controller with every shared service on another host, and the same
# controller hosting them all: the swarm UI's links must not tell the two
# apart.
controllerAlone = hive { deploy.swarm-controller.enable = true; };
inherit (shared) controllerAlone;
controllerWithServices = hive {
deploy.swarm-controller.enable = true;
deploy.allSwarmServices = true;