vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

Browse source
This commit is contained in:
atlas 2026-10-28 23:37:59 +01:00
commit 24afc89ab3
1 changed files with 707 additions and 172 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nix/host-modules/swarm-victoriametrics.nix
View file

@ -198,6 +198,7 @@ let
storeRefreshTimer = import ./lib/store-refresh-timer.nix { };
atomicWriteSecret = import ./lib/atomic-write-secret.nix { };
refreshConsumer = import ./lib/refresh-consumer.nix { };
rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
in
{
# What the store IS from any hive's point of view, the name it answers on,
@ -728,6 +729,8 @@ in
systemd.timers.${forwarderFetchUnit} =
storeRefreshTimer "re-read the metrics store forwarder's OIDC client secret from the swarm secret store";
systemd.services."container@${cfg.machine}" = rootfsCheck.warnOnly cfg.machine;
containers.${cfg.machine} = {
autoStart = true;
ephemeral = false;