run attic as a swarm service with deploy.attic.enable
This commit is contained in:
atlas
parent
f59ed01353
commit
458a046b8d
1 changed files with 1242 additions and 66 deletions
|
|
@ -20,6 +20,7 @@ let
|
|||
;
|
||||
})
|
||||
hive
|
||||
hiveWithController
|
||||
runGroup
|
||||
;
|
||||
|
||||
|
|
@ -66,7 +67,43 @@ let
|
|||
svc = inner.systemd.services.swarm-builder;
|
||||
env = svc.environment;
|
||||
hasOnPath = name: s: lib.any (p: lib.getName p == name) s.path;
|
||||
withoutCache = servicesHere.containers.swarm-builder.config.systemd.services.swarm-builder;
|
||||
# A builder with no cache named anywhere.
|
||||
withBuilderNoCache = hive {
|
||||
deploy.bao.enable = true;
|
||||
deploy.builder.enable = true;
|
||||
};
|
||||
withoutCache = withBuilderNoCache.containers.swarm-builder.config.systemd.services.swarm-builder;
|
||||
|
||||
# Hosting the shared services runs the swarm's own cache, which names itself.
|
||||
atticHere = servicesHere;
|
||||
atticDeploy = atticHere.services.hyperhive.deploy.attic;
|
||||
atticSwarm = m: m.services.hyperhive.swarm.attic;
|
||||
atticUnit = atticHere.containers.swarm-attic.config.systemd.services.swarm-attic;
|
||||
atticSecret = atticHere.systemd.services.swarm-bao-attic-secret;
|
||||
atticTokens = atticHere.systemd.services.swarm-bao-attic-tokens;
|
||||
atticVhost = atticHere.services.hyperhive.gateway.vhosts."attic.t.local";
|
||||
|
||||
# The cache switched on while the operator names the options by hand.
|
||||
atticByHand = hive {
|
||||
deploy.bao.enable = true;
|
||||
deploy.attic.enable = true;
|
||||
swarm.attic.domain = "cache.example.org";
|
||||
swarm.attic.cache = "grid";
|
||||
};
|
||||
|
||||
# An external cache on a host that hosts the shared services: the switch forced
|
||||
# off, the two options named.
|
||||
atticExternal = hiveWithController {
|
||||
deploy.allSwarmServices = true;
|
||||
deploy.attic.enable = lib.mkForce false;
|
||||
swarm.attic.domain = "cache.example.org";
|
||||
swarm.attic.cache = "grid";
|
||||
};
|
||||
hasAtticHost =
|
||||
m:
|
||||
m.containers ? swarm-attic
|
||||
|| m.systemd.services ? swarm-bao-attic-secret
|
||||
|| m.systemd.services ? swarm-bao-attic-tokens;
|
||||
|
||||
# The check flake on the inputs the builder's unit names, called as
|
||||
# `nix build` calls it. `hyperhive` is entered through the filtered source's
|
||||
|
|
@ -271,6 +308,102 @@ let
|
|||
autheliaHere.containers.swarm-authelia.config.systemd.services.swarm-secret-publish.script
|
||||
);
|
||||
}
|
||||
{
|
||||
# The switch is on wherever the shared services are and the host holds the
|
||||
# cache's leaf, and the two options every host reads come from the cache.
|
||||
# The builder on the same host pushes to it. `bare` is the control that the
|
||||
# lookup reads null where nothing runs a cache.
|
||||
name = "hosting the shared services runs the swarm's cache and fills the cache options, which the builder follows";
|
||||
ok =
|
||||
atticDeploy.enable
|
||||
&& atticHere.containers ? swarm-attic
|
||||
&& atticHere.services.hyperhive.deploy.bao.atticClientCertFile != null
|
||||
&& atticHere.services.hyperhive.deploy.bao.atticClientKeyFile != null
|
||||
&& (atticSwarm atticHere).domain == "attic.t.local"
|
||||
&& (atticSwarm atticHere).cache == "swarm"
|
||||
&&
|
||||
atticHere.containers.swarm-builder.config.systemd.services.swarm-builder.environment.SWARM_BUILDER_ATTIC_DOMAIN
|
||||
== "attic.t.local"
|
||||
&&
|
||||
atticHere.containers.swarm-builder.config.systemd.services.swarm-builder.environment.SWARM_BUILDER_ATTIC_CACHE
|
||||
== "swarm"
|
||||
&& (atticSwarm bare).domain == null
|
||||
&& (atticSwarm bare).cache == null
|
||||
&& !(hasAtticHost bare);
|
||||
}
|
||||
{
|
||||
# Names the operator gives win over the cache's own, and the gateway then
|
||||
# serves the cache under the operator's name. `atticHere` is the control
|
||||
# that the same lookups find the defaults.
|
||||
name = "options named by hand win over the cache's defaults";
|
||||
ok =
|
||||
atticByHand.services.hyperhive.deploy.attic.enable
|
||||
&& atticByHand.containers ? swarm-attic
|
||||
&& (atticSwarm atticByHand).domain == "cache.example.org"
|
||||
&& (atticSwarm atticByHand).cache == "grid"
|
||||
&& atticByHand.services.hyperhive.gateway.vhosts ? "cache.example.org"
|
||||
&& !(atticByHand.services.hyperhive.gateway.vhosts ? "attic.t.local")
|
||||
&& atticHere.services.hyperhive.gateway.vhosts ? "attic.t.local";
|
||||
}
|
||||
{
|
||||
# An operator's external cache on a host that hosts the shared services:
|
||||
# with the switch forced off nothing of the cache is rendered, and the
|
||||
# options keep what was named. `atticHere` is the control that the same
|
||||
# lookups find the cache's pieces where it runs.
|
||||
name = "with the cache switched off the options are the operator's and no cache runs";
|
||||
ok =
|
||||
!atticExternal.services.hyperhive.deploy.attic.enable
|
||||
&& !(hasAtticHost atticExternal)
|
||||
&& !(atticExternal.services.hyperhive.gateway.vhosts ? "attic.t.local")
|
||||
&& (atticSwarm atticExternal).domain == "cache.example.org"
|
||||
&& (atticSwarm atticExternal).cache == "grid"
|
||||
&&
|
||||
atticExternal.containers.swarm-builder.config.systemd.services.swarm-builder.environment.SWARM_BUILDER_ATTIC_DOMAIN
|
||||
== "cache.example.org"
|
||||
&& hasAtticHost atticHere
|
||||
&& atticHere.systemd.services ? swarm-bao-attic-secret
|
||||
&& atticHere.systemd.services ? swarm-bao-attic-tokens;
|
||||
}
|
||||
{
|
||||
# Both host units log in as the cache's principal, not the hive's, and
|
||||
# the container reaches the key through a read-only directory. The
|
||||
# unit script holds the create calls only in ./lib/attic-init.nix, which a
|
||||
# script test runs.
|
||||
name = "the cache's host units use its own store leaf, and the container gets the key read-only";
|
||||
ok =
|
||||
atticSecret.environment.BAO_CLIENT_CERT == "/var/lib/swarm-bao-pki/attic.pem"
|
||||
&& atticSecret.environment.BAO_CLIENT_KEY == "/var/lib/swarm-bao-pki/attic-key.pem"
|
||||
&& atticTokens.environment.BAO_CLIENT_CERT == "/var/lib/swarm-bao-pki/attic.pem"
|
||||
&& atticSecret.serviceConfig.Type == "oneshot"
|
||||
&& lib.elem "container@swarm-attic.service" atticSecret.before
|
||||
&& lib.elem "container@swarm-attic.service" atticTokens.after
|
||||
&& lib.elem "swarm-bao-attic-policy.service" atticSecret.after
|
||||
&& lib.elem "swarm-bao-attic-policy.service" atticTokens.after
|
||||
&& atticHere.containers.swarm-attic.bindMounts."/run/swarm-attic-secrets".isReadOnly
|
||||
&& !atticHere.containers.swarm-attic.privateNetwork
|
||||
&& atticUnit.serviceConfig.EnvironmentFile == "/run/swarm-attic-secrets/server.env"
|
||||
&& lib.hasInfix "--mode monolithic" atticUnit.serviceConfig.ExecStart
|
||||
&& atticDeploy.retentionPeriod == "14 days";
|
||||
}
|
||||
{
|
||||
# attic checks its own tokens and a nix client cannot follow a login
|
||||
# redirect, so the vhost carries no `auth_request`; the tokens ride in a
|
||||
# header, so it is TLS only; and a store path is one long upload.
|
||||
name = "the cache's vhost is TLS only, unauthenticated at the gateway and streams uploads, and its name is a swarm service name on every host";
|
||||
ok =
|
||||
let
|
||||
names = m: m.services.hyperhive.swarm.serviceDomains;
|
||||
in
|
||||
atticVhost.forceSSL
|
||||
&& atticVhost.locations."/".proxyPass == "http://127.0.0.1:8910"
|
||||
&& !(lib.hasInfix "auth_request" atticVhost.locations."/".extraConfig)
|
||||
&& lib.hasInfix "client_max_body_size 0" atticVhost.locations."/".extraConfig
|
||||
&& lib.hasInfix "proxy_request_buffering off" atticVhost.locations."/".extraConfig
|
||||
&& lib.elem "attic.t.local" (names atticHere)
|
||||
&& names atticHere == names bare
|
||||
&& names atticExternal == names bare
|
||||
&& !(lib.elem "cache.example.org" (names atticExternal));
|
||||
}
|
||||
];
|
||||
in
|
||||
runGroup "builder" cases
|
||||
|
|
|
|||
Loading…
Reference in a new issue