vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: comments state current behaviour, not history

Browse source 
Rewrite comments and option descriptions under nix/ that narrate how the
code got here ("used to", "new name", "sat at the TOP", "no longer",
renamed/moved narration, attributions) to say what the code does now and
why. Comments and description strings only; no logic changes.

Files in open PR #4970's diff are left alone. Refs #3902
This commit is contained in:
atlas 2026-10-05 02:34:39 +02:00
commit 1c90619fbb
45 changed files with 331 additions and 411 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/module-eval/grafana.nix
View file

@ -70,13 +70,11 @@ let
deploy.bao.grafanaOidcClientKeyFile = "/etc/pki/bao-grafana-oidc-key.pem";
};
# A Grafana host holding no store identity. This used to be the shape the
# module went QUIET on — no OIDC block, a warning, and a container whose
# login form is off regardless, so no way in and nothing failed. It is kept
# rather than deleted because the shape is still reachable by an operator;
# what changed is the deliverable, from a warning nothing reads back to a
# refusal naming the two options to set. Only the identity is missing, so an
# arm below can name which refusal fired.
# A Grafana host holding no store identity. The module refuses it with an
# assertion naming the two options to set, rather than going QUIET: no OIDC
# block can render and the container's login form is off regardless, so
# there would be no way in and nothing would fail. Only the identity is
# missing, so an arm below can name which refusal fired.
grafanaNoIdentity = hive {
deploy.grafana.enable = true;
deploy.grafana.plugins = [ ];
@ -104,9 +102,9 @@ let
) m.assertions;
cases = [
{
# This fixture enables grafana and NOT authelia, which is the shape the
# login form used to stay enabled in: the toggle read "both services are
# on this host" rather than "grafana requires SSO". Grafana ships an
# This fixture enables grafana and NOT authelia, so the login-form toggle
# has to follow "grafana requires SSO" rather than "both services are on
# this host". Grafana ships an
# `admin`/`admin` account and its vhost is on the public gateway, so a
# password box there is a way in whatever the topology.
name = "grafana disables its local login form even where authelia is not on this host";