nix: gate hive-c0re on deploy.hive-controller.enable, drop hyperhive.enable
`services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone. One switch, `services.hyperhive.deploy.hive-controller.enable` (default false, as the old toggle was), now gates hive-c0re and hive-priv. Both old paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config that still sets either evaluates as before and gets a rename warning. Every other read of the old toggle is resolved, including the 29 made through the `hyperhiveCfg`/`hiveCfg` aliases: - Dropped: each swarm service and its glue keeps only its own deploy toggle (authelia, bao and its PKI glue, grafana, victorialogs, victoriametrics, the secret publisher, swarm-ca, the OIDC client rows, the controller/nats/matrix-ctl/publisher/services-issuer identities), the forge, and the `domain` deprecation warning. - To deploy.hive-controller.enable: the queue-agent credential reader and its assertion, which feed hive-c0re and write under its state dir, plus their policy-order entry; the network identity assertions; hive-tls's two writes into hive-c0re's environment. - hive-tls runs where the gateway runs self-signed (`gateway.enable && useSelfSigned`), not on every host. - The matrix appservice-token reader and its assertion stay on `deploy.matrix.enable` plus their client-identity checks. They read deploy.matrix's token file and registration script; their deploy.bao inputs are the client-half options a hive sets to read a store it does not run, so gating on deploy.bao.enable would drop the tested remote-reader case. - The `hiveName` assertion moves from hive-network.nix to hyperhive.nix and fires wherever the hive, the store or the homeserver runs: each turns the name into an identifier with no fallback. On a host with `deploy.allSwarmServices` and no hive, the documented services-host recipe, authelia, bao, grafana, victorialogs, victoriametrics, the OIDC client rows and the hive CA now render; before, the old toggle being off left them out. Refs #4500
This commit is contained in:
atlas
parent
ed2ec52fe5
commit
3202cde704
43 changed files with 292 additions and 162 deletions
|
|
@ -1,7 +1,6 @@
|
|||
# Top-level, cross-cutting hyperhive options: the master enable
|
||||
# switch, the hive's identity (domain + display names), and hive-wide
|
||||
# feature toggles read by several subsystem modules. Imported by the
|
||||
# ./default.nix aggregator.
|
||||
# Top-level, cross-cutting hyperhive options: the hive's identity
|
||||
# (domain + display names) and hive-wide feature toggles read by several
|
||||
# subsystem modules. Imported by the ./default.nix aggregator.
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
|
|
@ -22,13 +21,9 @@ in
|
|||
)
|
||||
];
|
||||
|
||||
# Top-level hyperhive enable flag. When true, automatically enables
|
||||
# hive-c0re and the on-by-default hyperhive subsystems.
|
||||
options.services.hyperhive.enable = lib.mkEnableOption "hyperhive — the agent swarm coordinator";
|
||||
|
||||
# Canonical hive DNS domain shared by every subsystem that needs a
|
||||
# stable hostname. Typed nullOr (default null) so the option always
|
||||
# exists, but it's REQUIRED whenever hyperhive is enabled — an
|
||||
# exists, but it's REQUIRED wherever this host runs a hive — an
|
||||
# assertion in hive-network.nix fails eval when it's unset, since
|
||||
# matrix bakes it in on first boot and the gateway/forge/agent URLs all
|
||||
# derive from it (no safe default). Full identity-surface
|
||||
|
|
@ -61,7 +56,8 @@ in
|
|||
stable name (currently: `services.hyperhive.swarm.matrix.serverName`
|
||||
derives from this, defaulting to
|
||||
`matrix.''${services.hyperhive.domain}` when `serverName` is
|
||||
null). **Required** when `services.hyperhive.enable` — eval fails
|
||||
null). **Required** when
|
||||
`services.hyperhive.deploy.hive-controller.enable` — eval fails
|
||||
with a helpful message if it's unset (it's baked into matrix on
|
||||
first boot and drives the gateway/forge/agent URLs, with no safe
|
||||
default; changing it later is destructive). Exposed to agents as
|
||||
|
|
@ -88,24 +84,22 @@ in
|
|||
# nothing — measured, after this warning fired on the conventional
|
||||
# case. `mkOptionDefault` is priority 1500, so anything lower is a
|
||||
# definition someone actually wrote (100 plain, 1000 mkDefault).
|
||||
config.warnings =
|
||||
lib.optional (hiveCfg.enable && options.services.hyperhive.domain.highestPrio < 1500)
|
||||
''
|
||||
services.hyperhive.domain is set explicitly and is deprecated. This
|
||||
hive's address belongs in the swarm directory, which every hive in
|
||||
the swarm shares a copy of:
|
||||
config.warnings = lib.optional (options.services.hyperhive.domain.highestPrio < 1500) ''
|
||||
services.hyperhive.domain is set explicitly and is deprecated. This
|
||||
hive's address belongs in the swarm directory, which every hive in
|
||||
the swarm shares a copy of:
|
||||
|
||||
services.hyperhive.swarm.hives."${toString hiveCfg.hiveName}".domain = "${toString hiveCfg.domain}";
|
||||
services.hyperhive.swarm.hives."${toString hiveCfg.hiveName}".domain = "${toString hiveCfg.domain}";
|
||||
|
||||
(Or drop the value entirely if it is the conventional
|
||||
`<hiveName>.<swarm.domain>` — that is the directory entry's own
|
||||
default.)
|
||||
(Or drop the value entirely if it is the conventional
|
||||
`<hiveName>.<swarm.domain>` — that is the directory entry's own
|
||||
default.)
|
||||
|
||||
Setting it here still wins, so nothing is broken right now. What it
|
||||
does not do is tell the other hives: they read this hive's address
|
||||
out of their copy of the directory, so a value written only here
|
||||
leaves them pointing somewhere else with nothing detecting it.
|
||||
'';
|
||||
Setting it here still wins, so nothing is broken right now. What it
|
||||
does not do is tell the other hives: they read this hive's address
|
||||
out of their copy of the directory, so a value written only here
|
||||
leaves them pointing somewhere else with nothing detecting it.
|
||||
'';
|
||||
|
||||
# Where the swarm lives. Declared beside the hive's own identity
|
||||
# because it is what that identity is derived FROM — every hive in a
|
||||
|
|
@ -123,7 +117,8 @@ in
|
|||
`services.hyperhive.hiveName`, list the hives by name, and no
|
||||
hive in the swarm states an address at all.
|
||||
|
||||
**Required** when `services.hyperhive.enable`, and deliberately
|
||||
**Required** when
|
||||
`services.hyperhive.deploy.hive-controller.enable`, and deliberately
|
||||
not defaulted: there is no fallback worth having. A guessed
|
||||
swarm domain is a wrong hostname that evaluates cleanly and
|
||||
deploys, which is worse than an eval failure telling an
|
||||
|
|
@ -144,7 +139,10 @@ in
|
|||
example = "pr1ma";
|
||||
description = ''
|
||||
Human-readable name of this single-host hive instance.
|
||||
**Required** when `services.hyperhive.enable`. Distinct from
|
||||
**Required** when this host runs a hive, the swarm's secret store
|
||||
or its homeserver
|
||||
(`services.hyperhive.deploy.hive-controller.enable`,
|
||||
`deploy.bao.enable`, `deploy.matrix.enable`). Distinct from
|
||||
`services.hyperhive.domain` (the machine-addressable DNS name)
|
||||
but no longer merely cosmetic: a hive occupies
|
||||
`<hiveName>.<swarm.domain>`, so this is the label the hive is
|
||||
|
|
@ -154,6 +152,28 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
# Each of these deployments turns `hiveName` into an identifier with no
|
||||
# fallback: hive-c0re's OIDC client and matrix localpart, the CN of the
|
||||
# store's `client.pem` (./glue-bao-tls.nix), and the `hives/<name>` path
|
||||
# the matrix token and queue credential readers fetch. A null there renders
|
||||
# as an empty string that evaluates and deploys.
|
||||
config.assertions = [
|
||||
{
|
||||
assertion =
|
||||
!(
|
||||
hiveCfg.deploy.hive-controller.enable || hiveCfg.deploy.bao.enable || hiveCfg.deploy.matrix.enable
|
||||
)
|
||||
|| hiveCfg.hiveName != null;
|
||||
message = ''
|
||||
hyperhive requires services.hyperhive.hiveName to be set on a host
|
||||
that runs a hive, the swarm's secret store or its homeserver — it is
|
||||
this hive's label within the swarm, and the leftmost part of the
|
||||
domain it is addressed by (`<hiveName>.<swarm.domain>`), not only a
|
||||
display name. Set it (`services.hyperhive.hiveName = "pr1ma";`).
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
||||
# The one hive-level option that describes something ABOVE the hive,
|
||||
# which is why it sits under `swarm` with the swarm-global services
|
||||
# rather than beside `hiveName`.
|
||||
|
|
|
|||
Loading…
Reference in a new issue