vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

glue: hive-otel's ordering after authelia moves out of the otel module

Browse source 
The hive collector's secret-wait unit read deploy.authelia.enable to
order itself after authelia's container. That ordering is now set by
glue-hive-otel-authelia.nix, which restates the unit's own gate (otel's
`waits`). The rendered unit is unchanged.

The hive-otel module-eval fixture `hiveOtel` gains authelia, and a case
pins the edge with authelia here and its absence without.

Part of #3742.
This commit is contained in:
atlas 2026-10-13 10:35:25 +02:00 • committed by mara
commit 40ebd45c66
4 changed files with 64 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/host-modules/otel.nix
View file

@ -340,6 +340,7 @@ in
fetches = senderAuth && hiveLeaf && otel.clientSecretFile == fetchedSecretPath;
# An operator-delivered file has no unit that restarts the collector
# once it lands, so the collector waits for it instead.
# ./glue-hive-otel-authelia.nix restates this gate.
waits = senderAuth && !fetches;
secretWaitUnit = "hive-otel-client-secret";
# Written by swarm-secret-publish on authelia's host. The nix half of
@ -752,11 +753,9 @@ in
# transaction and gates on it. Stating the order from both sides too
# would be one more thing to keep consistent for no added guarantee.
#
# When authelia runs on this host the named file may be one it mints.
# Elsewhere there is no local unit to order against — naming one that
# does not exist orders nothing, silently.
after = lib.optional deployCfg.authelia.enable "container@${autheliaCfg.machine}.service";
requires = lib.optional deployCfg.authelia.enable "container@${autheliaCfg.machine}.service";
# Where authelia runs on this host the named file may be one it mints;
# ./glue-hive-otel-authelia.nix orders this unit after its container
# and restates `waits`.
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;