vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

service urls carry no gateway port, httpsPort is listen-only

Browse source
This commit is contained in:
atlas 2026-10-25 02:00:20 +02:00 • committed by mara
commit 19680a8b78
25 changed files with 105 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/module-eval/core-toggle.nix
View file

@ -64,12 +64,12 @@ let
otel.debug = true;
};
# The controller behind a gateway on a non-default TLS port: the only
# fixture whose collector URL carries a port. Only the controller's
# environment is read off it.
# The controller behind a gateway on a non-default TLS port, with the
# firewall opened. Its collector URL and its listener are read off it.
controllerAltPort = hive {
deploy.swarm-controller.enable = true;
gateway.httpsPort = 8443;
gateway.openFirewall = true;
};
# On the store's host, which mints the runner's store identity.
@ -167,6 +167,27 @@ let
name = "the all-local mode turns the swarm controller on";
ok = allLocal.services.hyperhive.deploy.swarm-controller.enable;
}
{
# `gateway.httpsPort` is a listen setting: the nginx TLS listener and the
# opened firewall port follow it, while a service URL built on the same
# host stays `https://<domain>`. The listener and firewall arms are the
# control that the port took effect on this fixture, so the URL arm
# cannot pass on a fixture where it was never set.
name = "a non-default gateway TLS port moves the listener and firewall, not the service URLs";
ok =
let
otel = controllerAltPort.services.hyperhive.swarm.otel;
listen = controllerAltPort.services.nginx.virtualHosts."_".listen;
tcp = controllerAltPort.networking.firewall.allowedTCPPorts;
url =
controllerAltPort.systemd.services.swarm-controller.environment.OTEL_EXPORTER_OTLP_ENDPOINT or null;
in
lib.any (l: l.port == 8443 && (l.ssl or false)) listen
&& !(lib.any (l: l.port == 443) listen)
&& lib.elem 8443 tcp
&& !(lib.elem 443 tcp)
&& url == "https://${otel.domain}/${otel.producerName}";
}
{
# ../host-modules/glue-controller-env.nix: the controller always exports to
# the swarm's collector. `controllerAlone` runs no collector of its own
@ -195,9 +216,6 @@ let
(env shared.controllerAlone).OTEL_EXPORTER_OTLP_ENDPOINT or null
== "https://${otel.domain}/${otel.producerName}"
&& (env shared.controllerAlone).SWARM_CONTROLLER_OTEL_AUDIENCE or null == clientId
&&
(env controllerAltPort).OTEL_EXPORTER_OTLP_ENDPOINT or null
== "https://${otel.domain}:8443/${otel.producerName}"
&& !(centralToggleOff.systemd.services ? swarm-controller);
}
{