vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: allSwarmServices turns on the review classifier

Browse source 
deploy.review-classifier.enable now defaults to allSwarmServices, as the
other shared services do, but only where the host has the classifier's
store identity (deploy.bao.reviewClassifierClient{Cert,Key}File). The
classifier module asserts that pair; glue-bao-tls.nix mints it only on the
host that runs the store, so a services host with the store placed
elsewhere would otherwise fail eval. An explicit value still wins.

The operator still writes the Anthropic key by hand; until then each run
fails with "no API key…" while the service runs.
This commit is contained in:
atlas 2026-10-12 10:48:32 +02:00 • committed by mara
commit 34bde7a5af
5 changed files with 67 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nix/host-modules/swarm-required-services.nix
View file

@ -105,4 +105,16 @@ in
# `singleHostSwarm` box, which gets here through `allSwarmServices`, would
# have no forge at all.
config.services.hyperhive.deploy.forgejo.enable = lib.mkDefault deployCfg.allSwarmServices;
# The review classifier. Its module asserts a store identity, which
# glue-bao-tls.nix mints only on the host that runs the store; with the store
# placed elsewhere both files stay null and an unconditional `true` here would
# fail that host's eval. So the default follows the identity, and a host
# holding a copy of the pair (`deploy.bao.reviewClassifierClient{Cert,Key}File`)
# gets the classifier too.
config.services.hyperhive.deploy.review-classifier.enable = lib.mkDefault (
deployCfg.allSwarmServices
&& deployCfg.bao.reviewClassifierClientCertFile != null
&& deployCfg.bao.reviewClassifierClientKeyFile != null
);
}