vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

warn when the in-swarm cache runs under another domain

Browse source
This commit is contained in:
atlas 2026-10-29 01:12:27 +01:00 • committed by mara
commit 4f32948a97
1 changed files with 37 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/host-modules/swarm-attic.nix
View file

@ -223,6 +223,23 @@ in
}
];
# Not an assertion: a cache served under a name of the operator's own is a
# working setup, and an assertion would fail it.
warnings = lib.optional (atticCfg.domain != atticCfg.ownDomain) ''
services.hyperhive.deploy.attic.enable is on while
services.hyperhive.swarm.attic.domain is "${toString atticCfg.domain}", not
the swarm cache's own name "${atticCfg.ownDomain}". This host runs the
swarm's cache and its gateway serves that name, so pushes to an external
cache there fail the certificate check.
For an external cache, set
services.hyperhive.deploy.attic.enable = lib.mkForce false; where the
shared services are hosted ("To use an external cache, override the two
defaults and don't set `deploy.attic.enable` anywhere", docs/swarm/builder.md).
For the swarm's own cache, drop the override of
services.hyperhive.swarm.attic.domain.
'';
# nspawn fails to start the container when a credential source is
# missing, so where this host mints the leaf the container waits for it. The
# CA ordering keeps the trust bundle's bind source there first.