vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move the small per-service host options to deploy.<service>

Browse source
This commit is contained in:
atlas 2026-10-29 01:48:34 +01:00 • committed by mara
commit 525de62b06
6 changed files with 407 additions and 251 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/module-eval/bao-otel-collector.nix
View file

@ -194,7 +194,7 @@ let
ok =
let
s = (baoForwarder baoWithCollector).settings;
port = baoWithCollector.services.hyperhive.swarm.bao.otel.telemetryPort;
port = baoWithCollector.services.hyperhive.deploy.bao.otel.telemetryPort;
in
selfScrapes s port { container = "bao"; }
&& s.service.pipelines.metrics.receivers == [ "prometheus" ]

2
nix/module-eval/builder.nix
View file

@ -253,7 +253,7 @@ let
name = "the builder builds on the hyperhive and nixpkgs this host was deployed with";
ok =
env.SWARM_BUILDER_HYPERHIVE_FLAKE == withBuilder.services.hyperhive.c0re.hyperhiveFlake
&& env.SWARM_BUILDER_NIXPKGS_FLAKE == withBuilder.services.hyperhive.c0re.nixpkgsFlake
&& env.SWARM_BUILDER_NIXPKGS_FLAKE == withBuilder.services.hyperhive.deploy.builder.nixpkgsFlake
&& lib.hasSuffix "-check-flake" env.SWARM_BUILDER_CHECK_FLAKE
&& env.SWARM_BUILDER_SYSTEM == pkgs.stdenv.hostPlatform.system
&& env.SWARM_BUILDER_CONFIG_ORG == "agent-configs"

109
nix/module-eval/core-toggle.nix
View file

@ -1512,6 +1512,115 @@ let
&& serve.model_prices.haiku.cache_write == 2.0
&& allLocal.users.groups.hive-admin.members == [ ];
}
{
# Each old spelling lands on the new path, with its own rename warning,
# and its value reaches the unit or vhost that reads it. Ports are chosen
# so three of them collide on purpose: the bao collector's telemetry
# port equals the NATS monitor port and the forge forwarder's, and the
# NATS forwarder's equals the log store forwarder's. Each of the three
# colocation assertions must read the moved options to see it.
name = "the per-service settings moved to deploy.* still apply from their old paths, with a rename warning each";
ok =
let
marker = name: pkgs.runCommand "auth-marker-${name}" { } "mkdir $out";
old = hiveWithController {
deploy.singleHostSwarm = true;
deploy.victorialogs.authPackage = marker "logs";
deploy.victorialogs.grafanaAuthPackage = marker "logs-grafana";
deploy.victoriametrics.authPackage = marker "metrics";
deploy.victoriametrics.agentAuthPackage = marker "metrics-agent";
c0re.nixpkgsFlake = "path:/legacy/nixpkgs";
swarm = {
controller.queue.natsUrl = "tls://queue.legacy.example:4333";
controller.queue.tokenEndpoint = "https://auth.legacy.example/api/oidc/token";
bao.otel.telemetryPort = 8898;
nats.monitorPort = 8898;
nats.metricsPort = 17777;
nats.otel.telemetryPort = 8897;
otel.telemetryPort = 18889;
victorialogs.port = 19428;
forge.httpPort = 13000;
matrix.allowEncryption = true;
};
};
d = old.services.hyperhive.deploy;
sw = old.services.hyperhive.swarm;
warned =
path:
lib.any (
w: lib.hasInfix "services.hyperhive.${path}" w && lib.hasInfix "has been renamed" w
) old.warnings;
locs = domain: old.services.nginx.virtualHosts.${domain}.locations;
refused = m: part: lib.any (a: !a.assertion && lib.hasInfix part a.message) m.assertions;
in
d.swarm-controller.queue.natsUrl == "tls://queue.legacy.example:4333"
&& d.swarm-controller.queue.tokenEndpoint == "https://auth.legacy.example/api/oidc/token"
&&
old.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_NATS_URL
== "tls://queue.legacy.example:4333"
&&
old.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_OIDC_TOKEN_ENDPOINT
== "https://auth.legacy.example/api/oidc/token"
&& d.bao.otel.telemetryPort == 8898
&& d.nats.monitorPort == 8898
&& d.nats.metricsPort == 17777
&& d.nats.otel.telemetryPort == 8897
&& d.swarm-otel.telemetryPort == 18889
&& d.victorialogs.port == 19428
&& d.forgejo.httpPort == 13000
&& d.matrix.allowEncryption
&& d.builder.nixpkgsFlake == "path:/legacy/nixpkgs"
&&
old.containers.swarm-builder.config.systemd.services.swarm-builder.environment.SWARM_BUILDER_NIXPKGS_FLAKE
== "path:/legacy/nixpkgs"
&& (locs sw.nats.domain)."= /metrics".proxyPass == "http://127.0.0.1:17777/metrics"
&& (locs sw.victorialogs.domain)."= /metrics".proxyPass == "http://127.0.0.1:19428/metrics"
&& (locs sw.forge.domain)."/".proxyPass == "http://127.0.0.1:13000/"
&& old.containers.hive-matrix.config.services.matrix-tuwunel.settings.global.allow_encryption
&& lib.all warned [
"swarm.controller.queue.natsUrl"
"swarm.controller.queue.tokenEndpoint"
"swarm.bao.otel.telemetryPort"
"swarm.nats.monitorPort"
"swarm.nats.metricsPort"
"swarm.nats.otel.telemetryPort"
"swarm.otel.telemetryPort"
"swarm.victorialogs.port"
"swarm.forge.httpPort"
"swarm.matrix.allowEncryption"
"c0re.nixpkgsFlake"
]
&& !(lib.any (w: lib.hasInfix "swarm.controller.queue" w) allLocal.warnings)
&& refused old "deploy.nats.otel.telemetryPort"
&& refused old "The forge's journal forwarder's telemetry port"
&& refused old "The log store's journal forwarder's telemetry port"
&& !(refused allLocal "deploy.nats.otel.telemetryPort")
&& !(refused allLocal "The forge's journal forwarder's telemetry port")
&& !(refused allLocal "The log store's journal forwarder's telemetry port");
}
{
# The default render of the moved options, pinned so moving them changes
# none of it: the ports in the vhosts and the collector config, the
# controller's queue coordinates, the homeserver's encryption switch.
name = "the per-service defaults reach their units and vhosts unchanged";
ok =
let
h = allLocal.services.hyperhive;
locs = domain: allLocal.services.nginx.virtualHosts.${domain}.locations;
env = allLocal.systemd.services.swarm-controller.environment;
in
allLocal.services.hyperhive.deploy.builder.nixpkgsFlake == "path:${pkgs.path}"
&& env.SWARM_CONTROLLER_NATS_URL == "tls://${h.swarm.nats.domain}:${toString h.swarm.nats.port}"
&& env.SWARM_CONTROLLER_OIDC_TOKEN_ENDPOINT == "${h.swarm.authelia.url}/api/oidc/token"
&& h.deploy.bao.otel.telemetryPort == 8890
&& h.deploy.nats.monitorPort == 8222
&& h.deploy.nats.otel.telemetryPort == 8891
&& h.deploy.swarm-otel.telemetryPort == 8889
&& (locs h.swarm.nats.domain)."= /metrics".proxyPass == "http://127.0.0.1:7777/metrics"
&& (locs h.swarm.victorialogs.domain)."= /metrics".proxyPass == "http://127.0.0.1:9428/metrics"
&& (locs h.swarm.forge.domain)."/".proxyPass == "http://127.0.0.1:3000/"
&& !allLocal.containers.hive-matrix.config.services.matrix-tuwunel.settings.global.allow_encryption;
}
{
# A hive's rendered identity, pinned so moving the option changes none of
# it: the coordinator's name and client, the dashboard name, the CN of the

8
nix/module-eval/nats-authelia.nix
View file

@ -155,7 +155,7 @@ let
taken = [
8888
8890
h.services.hyperhive.swarm.nats.otel.telemetryPort
h.services.hyperhive.deploy.nats.otel.telemetryPort
]
++ map (o: o.port) (lib.filter (o: o.machine != svc.machine) forwarderServices);
in
@ -265,7 +265,7 @@ let
taken = [
8888
8890
h.services.hyperhive.swarm.nats.otel.telemetryPort
h.services.hyperhive.deploy.nats.otel.telemetryPort
]
++ map (o: o.port) (lib.filter (o: o.machine != svc.machine) hostNetnsForwarders);
in
@ -737,7 +737,7 @@ let
&& s.extensions."oauth2client/swarm".endpoint_params.audience == clientId
&& lib.elem "oauth2client/swarm" s.service.extensions
&& s.service.pipelines.logs.receivers == [ "journald" ]
&& selfScrapes s h.services.hyperhive.swarm.nats.otel.telemetryPort { container = "nats"; }
&& selfScrapes s h.services.hyperhive.deploy.nats.otel.telemetryPort { container = "nats"; }
&& lib.elem "oidc-client-secret:/run/swarm-journal-forwarder-oidc/client-secret" c.systemd.services.opentelemetry-collector.serviceConfig.LoadCredential
&& fetch.environment.BAO_CLIENT_CERT == "/var/lib/swarm-nats-auth/bao-client.pem"
&& lib.hasInfix "bao kv get -field=value secret/swarm/services/${clientId}/oidc/client" fetch.script
@ -999,7 +999,7 @@ let
taken = [
8888
8890
h.services.hyperhive.swarm.nats.otel.telemetryPort
h.services.hyperhive.deploy.nats.otel.telemetryPort
]
++ map (o: o.port) hostNetnsForwarders;
in

8
nix/module-eval/nats-tls.nix
View file

@ -171,7 +171,7 @@ let
in
d.hive-controller.statusPublish.natsUrl == natsUrl
&& d.hive-controller.queue.agentNatsUrl == natsUrl
&& allLocal.services.hyperhive.swarm.controller.queue.natsUrl == natsUrl;
&& allLocal.services.hyperhive.deploy.swarm-controller.queue.natsUrl == natsUrl;
}
{
name = "the queue's name is served by this host's resolver, at the bridge address";
@ -317,7 +317,7 @@ let
&& lib.all (u: u == natsUrl) (lib.attrValues s)
&& d.hive-controller.statusPublish.natsUrl == natsUrl
&& d.hive-controller.queue.agentNatsUrl == natsUrl
&& remote.services.hyperhive.swarm.controller.queue.natsUrl == natsUrl;
&& remote.services.hyperhive.deploy.swarm-controller.queue.natsUrl == natsUrl;
}
{
# The URL is set and the hive holds no store leaf, which is every such
@ -387,14 +387,14 @@ let
]
&& locs."/".return == "403"
&& locs."/".proxyPass == null
&& locs."= /metrics".proxyPass == "http://127.0.0.1:${toString h.swarm.nats.metricsPort}/metrics"
&& locs."= /metrics".proxyPass == "http://127.0.0.1:${toString h.deploy.nats.metricsPort}/metrics"
&& checksOf locs."= /metrics" == [ "auth_request /__nats_metrics_authz;" ]
&& !(lib.hasInfix "error_page" locs."= /metrics".extraConfig)
&& authz.proxyPass == "https://auth.t.local/api/authz/auth-request"
&& lib.hasInfix "internal;" authz.extraConfig
&& !(lib.any (
l:
lib.hasInfix ":${toString h.swarm.nats.monitorPort}" (
lib.hasInfix ":${toString h.deploy.nats.monitorPort}" (
if l.proxyPass == null then "" else l.proxyPass
)
) (lib.attrValues locs))

2
nix/module-eval/swarm-otel-identity.nix
View file

@ -509,7 +509,7 @@ let
in
h.deploy.victorialogs.enable
&& locs ? "= /metrics"
&& locs."= /metrics".proxyPass == "http://127.0.0.1:${toString h.swarm.victorialogs.port}/metrics"
&& locs."= /metrics".proxyPass == "http://127.0.0.1:${toString h.deploy.victorialogs.port}/metrics"
&& checksOf locs."= /metrics" == [ "auth_request /__hive_authelia;" ]
&& !(lib.hasInfix "error_page" locs."= /metrics".extraConfig)
&& lib.hasInfix "error_page 401 =302" locs."/".extraConfig