vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

glue: forge's controller-dependent settings move out of the forge module

Browse source
This commit is contained in:
atlas 2026-10-13 08:47:07 +02:00 • committed by mara
commit 4a3f21fc2b
6 changed files with 59 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

34
nix/host-modules/hive-forge/default.nix
View file

@ -219,8 +219,7 @@ in
actionsFromSelf = lib.mkOption {
type = lib.types.bool;
default = deployCfg.swarm-controller.enable;
defaultText = lib.literalExpression "config.services.hyperhive.deploy.swarm-controller.enable";
default = false;
example = false;
description = ''
Resolve a workflow's `uses: <org>/<action>@vN` against this forge
@ -230,8 +229,9 @@ in
have something to resolve to. A CI job's actions then need no
external DNS; only the mirrors' re-sync does.
Defaults to on when this host runs the swarm-controller, which seeds
the mirrors, and off otherwise. Setting it `true` on a host without
Defaults to on when this host also runs the swarm-controller, which
seeds the mirrors (set by `glue-forge-controller.nix`), and off
otherwise. Setting it `true` on a host without
the controller leaves both actions unresolved: nothing seeds the
mirrors, and the warning about unseeded mirrors fires.
@ -240,6 +240,16 @@ in
'';
};
effectiveMirrors = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
internal = true;
readOnly = true;
description = ''
{option}`mirrors` plus the `actions/*` mirrors {option}`actionsFromSelf`
adds; what `glue-forge-controller.nix` forwards to the controller.
'';
};
# The other half of the SSO pair: the client *id* is swarm-wide (it has
# to match authelia's register), the secret is a path on this host. The
# design note for the login source itself is with the id.
@ -1238,17 +1248,11 @@ in
];
};
# Forward the declared pull-mirrors to the swarm-controller, which seeds
# them in its swarm-wide forge-objects pass
# (`swarm-controller/src/forge/objects.rs`), beside the orgs they live in.
# JSON-encoded list of { upstream, dest }; `[]` when nothing to seed.
#
# ⚠️ This host's `mirrors` reach a controller on THIS host only. A
# controller elsewhere reads its own host's list, so mirrors declared
# here would never be seeded; the warning below says so at eval rather
# than leaving it to be noticed as a missing repo.
systemd.services.swarm-controller.environment.SWARM_CONTROLLER_FORGE_MIRRORS =
lib.mkIf deployCfg.swarm-controller.enable (builtins.toJSON effectiveMirrors);
# The mirrors reach a controller on THIS host only (see
# ../glue-forge-controller.nix); a controller elsewhere reads its own
# host's list, so the warning below says so at eval rather than leaving
# it to be noticed as a missing repo.
services.hyperhive.deploy.forgejo.effectiveMirrors = effectiveMirrors;
warnings = lib.optional (effectiveMirrors != [ ] && !deployCfg.swarm-controller.enable) ''
services.hyperhive.deploy.forgejo.mirrors (or the actions/* mirrors
deploy.forgejo.actionsFromSelf adds) is set on a host that does not run the