vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

glue-matrix-bao-token: do not assert what the Before= ordering does

Browse source 
The retry comment claimed "every retry is time the homeserver may spend
waiting". That is the conservative reading, not a measured one, and argus
is right that it is probably wrong: systemd ordering typically resolves
once a unit's first start job completes, success or failure, and an
auto-restart after that is not a new ordering-relevant job.

If that holds, the container proceeds after the first failed attempt --
same timing as today -- and what the retries buy is the token file being
correct within ~60s for whatever starts next, rather than this boot's
race getting a second chance.

Both readings justify the same tight bound, for different reasons, so the
comment now says the ordering behaviour is unverified instead of picking
one. An agent container cannot reach a systemd manager to settle it.

Refs #4303
This commit is contained in:
atlas 2026-09-12 15:31:07 +02:00 • committed by mara
commit 4db746a22c
1 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/glue-matrix-bao-token.nix
View file

@ -80,11 +80,12 @@ in
# Sized for the race this loses, not for an unseal. `swarm-bao` comes up # Sized for the race this loses, not for an unseal. `swarm-bao` comes up
# seconds before this unit asks, and the cert-auth role it logs in # seconds before this unit asks, and the cert-auth role it logs in
# against is written seconds after — so a few short attempts cover it. # against is written seconds after — so a few short attempts cover it.
# ⚠️ `swarm-bao-controller-policy`'s 2880 × 30s is NOT the model to copy: # ⚠️ `swarm-bao-controller-policy`'s 2880 × 30s is NOT the model to copy.
# that unit blocks nothing, while this one is `Before=` the homeserver's # That unit blocks nothing; this one is `Before=` the homeserver's
# container, so every retry is time the homeserver may spend waiting. A # container, and whether that ordering waits across an auto-restart is
# store still sealed after this window keeps the degrade below, which is # unverified — so an hours-long window would be a bet on an unknown,
# the same place it ends up today. # where a minute is not. A store still sealed after it keeps the degrade
# below, as today.
# #
# `StartLimit*` are `[Unit]` settings, so they go here and not in # `StartLimit*` are `[Unit]` settings, so they go here and not in
# `serviceConfig` — systemd ignores them under `[Service]`. The window # `serviceConfig` — systemd ignores them under `[Service]`. The window