From 1948e7ad232353bdde2ef00b2ebfee8362fef034 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 26 Sep 2026 00:57:42 +0200 Subject: [PATCH] module-eval: read the services-leaf narrowing off a forge host `checks.module-eval-core-toggle` is red on main: "a gateway's services leaf asks for only the swarm names that host fronts" read its leaf request off `bare`, on the premise that `bare` fronts forge. That was true where the property was written, before 978164dc (#4705) defaulted `deploy.forgejo.enable` to false. The two merged in sequence, and on main `bare` renders only the `_` and `h1.t.local` vhosts, so its `localServiceDomains` is [] and the script carries `alt_names=''`, never `alt_names=forge.t.local`. The narrowing itself is right: a host that runs no forge fronts no swarm name and asks for no services leaf. Only the fixture was stale. The property now reads a hive with `deploy.forgejo.enable = true`, whose request is `common_name=forge.t.local alt_names=forge.t.local` while `auth.t.local` stays in the swarm-wide set. The renewal timer from 0649673e is not involved: the check's derivation is identical at 0649673e and at its parent, and ed2ec52f replayed onto 978164dc^ holds while replayed onto 978164dc it fails. Refs #4587 --- nix/module-eval/core-toggle.nix | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/nix/module-eval/core-toggle.nix b/nix/module-eval/core-toggle.nix index 53aecc1e..7a6a7827 100644 --- a/nix/module-eval/core-toggle.nix +++ b/nix/module-eval/core-toggle.nix @@ -205,15 +205,16 @@ let } { # A leaf is a key that can SERVE every name in it, so the names it - # asks for are that key's blast radius. `bare` fronts forge and - # nothing else; the last conjunct is the control, since `auth.t.local` - # is in the swarm's set and an unnarrowed request would carry it here - # too. + # asks for are that key's blast radius. The forge's host fronts forge + # and nothing else; the last conjunct is the control, since + # `auth.t.local` is in the swarm's set and an unnarrowed request would + # carry it here too. name = "a gateway's services leaf asks for only the swarm names that host fronts"; ok = let - s = bare.services.hyperhive.swarm.serviceDomains; - u = bare.systemd.services.swarm-services-cert.script; + forgeHere = hive { deploy.forgejo.enable = true; }; + s = forgeHere.services.hyperhive.swarm.serviceDomains; + u = forgeHere.systemd.services.swarm-services-cert.script; in lib.hasInfix "alt_names=forge.t.local" u && !(lib.hasInfix "auth.t.local" u)