vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

render the matrix appservice registration from the store onto tmpfs

Browse source 
swarm-matrix-ctl appservice render now reads the registration's tokens
from the store and renders swarm.yaml under /run/swarm-matrix-appservice,
which tuwunel loads through LoadCredential. It mints a pair only when the
store answers and holds none; a host that has the old files stores their
pair once instead. A store that does not answer fails the unit and keeps
tuwunel down; sync starts it once the store answers.

Refs #4998 (item 3)
This commit is contained in:
atlas 2026-10-30 05:47:39 +01:00 • committed by mara
commit 3a4b0ffabf
1 changed files with 594 additions and 378 deletions
Download patch file Download diff file Expand all files Collapse all files

17
swarm-matrix-ctl/README.md
View file

@ -13,18 +13,19 @@ crate.
### `appservice render`
Renders the swarm appservice registration tuwunel loads from the tokens in the
state dir, minting them only on a host that has none. Runs before the
homeserver and needs no network: the tokens on disk are the last copy `sync`
took from the store.
Renders the swarm appservice registration tuwunel loads from the store's tokens
onto the container's tmpfs, minting a pair only when the store answers and holds
none. Runs before the homeserver, which stays down while the store does not
answer. Tokens an earlier version kept in the container's `/var/lib` are stored
first when the store holds none; the files stay, unused.
### `appservice sync`
The store holds the registration's tokens. This writes them into the state dir
The store holds the registration's tokens. This rewrites the rendered copy
when they differ, restarts the homeserver whenever the registration is
newer than its last start, and publishes the `as_token` for `swarm-controller`. A store holding none is seeded from the
state dir, create-only, so nothing rotates. It runs beside the homeserver, so a
store outage leaves the homeserver running on the last copy.
newer than its last start, and publishes the `as_token` for `swarm-controller`.
It runs the same reconciliation as `render`, and starts a homeserver that
failed because `render` could not reach the store.
Both are configured entirely by the `MATRIX_APPSERVICE_*` environment the units
set — no flags. A systemd `Environment=` block is what a nix module can render; a