vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: drop 18 redundant cases and merge assertion-only hosts

Browse source 
Refs #5379
This commit is contained in:
atlas 2026-10-16 19:58:10 +02:00 • committed by mara
commit 2ff253e520
15 changed files with 122 additions and 359 deletions
Download patch file Download diff file Expand all files Collapse all files

43
nix/module-eval/bao-controller.nix
View file

@ -46,15 +46,25 @@ let
# files this host will never have.
controllerNoStore = shared.controllerAlone;
# A deployment that pinned `gatewayHost` away from its own swarm-domain
# default (`hive-matrix-service.nix`'s own doc: "To use the per-hive name
# Two independent matrix settings no default could supply, each read into
# its own controller variable.
#
# `gatewayHost` pinned away from its own swarm-domain default
# (`hive-matrix-service.nix`'s own doc: "To use the per-hive name
# ... instead, pin it here").
# Only this fixture can tell "the controller reads gatewayHost" apart from
# "the controller re-derives gatewayHost's default itself" — both render
# the same URL on every other fixture in this file.
controllerPinnedGateway = hive {
#
# An ignore list with two entries, so the case reading it also pins the
# separator the daemon splits on.
controllerPinnedMatrix = hive {
deploy.swarm-controller.enable = true;
swarm.matrix.gatewayHost = "matrix.hive.t.local";
swarm.matrix.adminSync.ignoreUsers = [
"@keep-a:t.local"
"@keep-b:t.local"
];
};
# No matrix vhost for this swarm at all, so there is no homeserver URL
@ -64,16 +74,6 @@ let
swarm.matrix.gatewayHost = null;
};
# An ignore list no default could supply, with two entries so the case below
# also pins the separator the daemon splits on.
controllerIgnoresAdmins = hive {
deploy.swarm-controller.enable = true;
swarm.matrix.adminSync.ignoreUsers = [
"@keep-a:t.local"
"@keep-b:t.local"
];
};
# The two authorities told apart. A deployment that self-signs both ends
# points `clientCaFile` and `serverCaFile` at one file, so on the fixture
# above the CA a hive is issued from and the CA the store is verified by are
@ -133,7 +133,7 @@ let
# the former passes.
name = "the controller's homeserver follows a pinned gatewayHost, not its own chat.<domain> default";
ok =
controllerPinnedGateway.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_MATRIX_HOMESERVER_URL
controllerPinnedMatrix.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_MATRIX_HOMESERVER_URL
or null == "https://matrix.hive.t.local";
}
{
@ -165,7 +165,7 @@ let
# an account the sync would revoke.
name = "the controller is told the operator admin sync's ignore list";
ok =
controllerIgnoresAdmins.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_MATRIX_ADMIN_SYNC_IGNORE_USERS
controllerPinnedMatrix.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_MATRIX_ADMIN_SYNC_IGNORE_USERS
or null == "@keep-a:t.local @keep-b:t.local";
}
{
@ -264,19 +264,6 @@ let
&& !builtins.elem "hive-client-ca.pem:/etc/pki/store-server-ca.pem" s.swarm-controller.serviceConfig.LoadCredential
&& m.deploy.swarm-controller.hiveClientCaFile == m.deploy.bao.clientCaFile;
}
{
# Same two-CA fixture, for the same reason: the wrapper verifies the
# STORE, so it takes `serverCaFile`. On a self-signing deployment both
# options name one file and either would pass; here the client CA in that
# slot is a case this arm fails.
#
# ⚠️ The package itself stays off `PATH` — `wrapProgram` renames the real
# binary, so an unwrapped `bao` is unreachable rather than merely
# discouraged. Operator's instruction, and the last assertion is what
# keeps a later "install the package too" from quietly undoing it.
name = "the host gets a wrapped bao CLI";
ok = baoWrapper != null;
}
{
name = "the wrapped bao CLI carries this store's address";
ok = lib.hasInfix "--set-default BAO_ADDR" baoWrapperCmd;