vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

Browse source
This commit is contained in:
atlas 2026-10-28 23:37:59 +01:00
commit 24afc89ab3
1 changed files with 707 additions and 172 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nix/host-modules/swarm-grafana.nix
View file

@ -24,6 +24,8 @@ let
baoCfg = hyperhiveCfg.swarm.bao;
baoDeploy = deployCfg.bao;
rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
caTrust = import ./lib/hive-ca-trust.nix {
inherit lib gatewayCfg;
tlsCfg = deployCfg.hive-controller.tls;
@ -686,6 +688,7 @@ in
# ./swarm-builder.nix's does.
systemd.services."container@${cfg.machine}" = lib.mkMerge [
caTrust.containerOrdering
(rootfsCheck.warnOnly cfg.machine)
{
after = [ "swarm-bao-pki.service" ];
wants = [ "swarm-bao-pki.service" ];