vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

warn when the in-swarm cache runs under another domain

Browse source
This commit is contained in:
atlas 2026-10-29 01:12:27 +01:00 • committed by mara
commit 4f32948a97
2 changed files with 37 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/host-modules/swarm-attic.nix
View file

@ -223,6 +223,23 @@ in
}
];
# Not an assertion: a cache served under a name of the operator's own is a
# working setup, and an assertion would fail it.
warnings = lib.optional (atticCfg.domain != atticCfg.ownDomain) ''
services.hyperhive.deploy.attic.enable is on while
services.hyperhive.swarm.attic.domain is "${toString atticCfg.domain}", not
the swarm cache's own name "${atticCfg.ownDomain}". This host runs the
swarm's cache and its gateway serves that name, so pushes to an external
cache there fail the certificate check.
For an external cache, set
services.hyperhive.deploy.attic.enable = lib.mkForce false; where the
shared services are hosted ("To use an external cache, override the two
defaults and don't set `deploy.attic.enable` anywhere", docs/swarm/builder.md).
For the swarm's own cache, drop the override of
services.hyperhive.swarm.attic.domain.
'';
# nspawn fails to start the container when a credential source is
# missing, so where this host mints the leaf the container waits for it. The
# CA ordering keeps the trust bundle's bind source there first.

17
nix/module-eval/builder.nix
View file

@ -110,6 +110,11 @@ let
swarm.attic.domain = "cache.example.org";
swarm.attic.cache = "grid";
};
atticWarnings =
m:
lib.length (
lib.filter (lib.hasInfix "services.hyperhive.deploy.attic.enable is on while") m.warnings
);
hasAtticHost =
m:
m.containers ? swarm-attic
@ -369,6 +374,18 @@ let
&& !(atticByHand.services.hyperhive.gateway.vhosts ? "attic.t.local")
&& atticHere.services.hyperhive.gateway.vhosts ? "attic.t.local";
}
{
# The cache running here under a name other than its own warns once, naming
# the fix. `atticHere` (default name) and `atticExternal` (cache off) are
# the controls that the same lookup finds no warning.
name = "the cache running under another name warns once, and the default and an external cache do not";
ok =
atticWarnings atticByHand == 1
&& lib.any (lib.hasInfix "lib.mkForce false") atticByHand.warnings
&& lib.any (lib.hasInfix "cache.example.org") atticByHand.warnings
&& atticWarnings atticHere == 0
&& atticWarnings atticExternal == 0;
}
{
# An operator's external cache on a host that hosts the shared services:
# with the switch forced off nothing of the cache is rendered, and the