vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move the small per-service host options to deploy.<service>

Browse source
This commit is contained in:
atlas 2026-10-29 01:48:34 +01:00 • committed by mara
commit 525de62b06
1 changed files with 407 additions and 251 deletions
Download patch file Download diff file Expand all files Collapse all files

109
nix/module-eval/core-toggle.nix
View file

@ -1512,6 +1512,115 @@ let
&& serve.model_prices.haiku.cache_write == 2.0
&& allLocal.users.groups.hive-admin.members == [ ];
}
{
# Each old spelling lands on the new path, with its own rename warning,
# and its value reaches the unit or vhost that reads it. Ports are chosen
# so three of them collide on purpose: the bao collector's telemetry
# port equals the NATS monitor port and the forge forwarder's, and the
# NATS forwarder's equals the log store forwarder's. Each of the three
# colocation assertions must read the moved options to see it.
name = "the per-service settings moved to deploy.* still apply from their old paths, with a rename warning each";
ok =
let
marker = name: pkgs.runCommand "auth-marker-${name}" { } "mkdir $out";
old = hiveWithController {
deploy.singleHostSwarm = true;
deploy.victorialogs.authPackage = marker "logs";
deploy.victorialogs.grafanaAuthPackage = marker "logs-grafana";
deploy.victoriametrics.authPackage = marker "metrics";
deploy.victoriametrics.agentAuthPackage = marker "metrics-agent";
c0re.nixpkgsFlake = "path:/legacy/nixpkgs";
swarm = {
controller.queue.natsUrl = "tls://queue.legacy.example:4333";
controller.queue.tokenEndpoint = "https://auth.legacy.example/api/oidc/token";
bao.otel.telemetryPort = 8898;
nats.monitorPort = 8898;
nats.metricsPort = 17777;
nats.otel.telemetryPort = 8897;
otel.telemetryPort = 18889;
victorialogs.port = 19428;
forge.httpPort = 13000;
matrix.allowEncryption = true;
};
};
d = old.services.hyperhive.deploy;
sw = old.services.hyperhive.swarm;
warned =
path:
lib.any (
w: lib.hasInfix "services.hyperhive.${path}" w && lib.hasInfix "has been renamed" w
) old.warnings;
locs = domain: old.services.nginx.virtualHosts.${domain}.locations;
refused = m: part: lib.any (a: !a.assertion && lib.hasInfix part a.message) m.assertions;
in
d.swarm-controller.queue.natsUrl == "tls://queue.legacy.example:4333"
&& d.swarm-controller.queue.tokenEndpoint == "https://auth.legacy.example/api/oidc/token"
&&
old.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_NATS_URL
== "tls://queue.legacy.example:4333"
&&
old.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_OIDC_TOKEN_ENDPOINT
== "https://auth.legacy.example/api/oidc/token"
&& d.bao.otel.telemetryPort == 8898
&& d.nats.monitorPort == 8898
&& d.nats.metricsPort == 17777
&& d.nats.otel.telemetryPort == 8897
&& d.swarm-otel.telemetryPort == 18889
&& d.victorialogs.port == 19428
&& d.forgejo.httpPort == 13000
&& d.matrix.allowEncryption
&& d.builder.nixpkgsFlake == "path:/legacy/nixpkgs"
&&
old.containers.swarm-builder.config.systemd.services.swarm-builder.environment.SWARM_BUILDER_NIXPKGS_FLAKE
== "path:/legacy/nixpkgs"
&& (locs sw.nats.domain)."= /metrics".proxyPass == "http://127.0.0.1:17777/metrics"
&& (locs sw.victorialogs.domain)."= /metrics".proxyPass == "http://127.0.0.1:19428/metrics"
&& (locs sw.forge.domain)."/".proxyPass == "http://127.0.0.1:13000/"
&& old.containers.hive-matrix.config.services.matrix-tuwunel.settings.global.allow_encryption
&& lib.all warned [
"swarm.controller.queue.natsUrl"
"swarm.controller.queue.tokenEndpoint"
"swarm.bao.otel.telemetryPort"
"swarm.nats.monitorPort"
"swarm.nats.metricsPort"
"swarm.nats.otel.telemetryPort"
"swarm.otel.telemetryPort"
"swarm.victorialogs.port"
"swarm.forge.httpPort"
"swarm.matrix.allowEncryption"
"c0re.nixpkgsFlake"
]
&& !(lib.any (w: lib.hasInfix "swarm.controller.queue" w) allLocal.warnings)
&& refused old "deploy.nats.otel.telemetryPort"
&& refused old "The forge's journal forwarder's telemetry port"
&& refused old "The log store's journal forwarder's telemetry port"
&& !(refused allLocal "deploy.nats.otel.telemetryPort")
&& !(refused allLocal "The forge's journal forwarder's telemetry port")
&& !(refused allLocal "The log store's journal forwarder's telemetry port");
}
{
# The default render of the moved options, pinned so moving them changes
# none of it: the ports in the vhosts and the collector config, the
# controller's queue coordinates, the homeserver's encryption switch.
name = "the per-service defaults reach their units and vhosts unchanged";
ok =
let
h = allLocal.services.hyperhive;
locs = domain: allLocal.services.nginx.virtualHosts.${domain}.locations;
env = allLocal.systemd.services.swarm-controller.environment;
in
allLocal.services.hyperhive.deploy.builder.nixpkgsFlake == "path:${pkgs.path}"
&& env.SWARM_CONTROLLER_NATS_URL == "tls://${h.swarm.nats.domain}:${toString h.swarm.nats.port}"
&& env.SWARM_CONTROLLER_OIDC_TOKEN_ENDPOINT == "${h.swarm.authelia.url}/api/oidc/token"
&& h.deploy.bao.otel.telemetryPort == 8890
&& h.deploy.nats.monitorPort == 8222
&& h.deploy.nats.otel.telemetryPort == 8891
&& h.deploy.swarm-otel.telemetryPort == 8889
&& (locs h.swarm.nats.domain)."= /metrics".proxyPass == "http://127.0.0.1:7777/metrics"
&& (locs h.swarm.victorialogs.domain)."= /metrics".proxyPass == "http://127.0.0.1:9428/metrics"
&& (locs h.swarm.forge.domain)."/".proxyPass == "http://127.0.0.1:3000/"
&& !allLocal.containers.hive-matrix.config.services.matrix-tuwunel.settings.global.allow_encryption;
}
{
# A hive's rendered identity, pinned so moving the option changes none of
# it: the coordinator's name and client, the dashboard name, the CN of the