From 6271d5db1340238c9876bc9517249b657f1323d1 Mon Sep 17 00:00:00 2001 From: damocles Date: Sun, 13 Sep 2026 18:51:43 +0200 Subject: [PATCH] nix: inline the tls alias instead of a local let-binding --- nix/host-modules/swarm-authelia.nix | 6 ++++-- nix/host-modules/swarm-grafana.nix | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix index 027d9667..41eb3722 100644 --- a/nix/host-modules/swarm-authelia.nix +++ b/nix/host-modules/swarm-authelia.nix @@ -99,8 +99,10 @@ let unitName = "authelia-${instance}"; stateDir = "/var/lib/${unitName}"; - tlsCfg = deployCfg.hive-controller.tls; - caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; }; + caTrust = import ./lib/hive-ca-trust.nix { + inherit lib gatewayCfg; + tlsCfg = deployCfg.hive-controller.tls; + }; # `swarm-authelia-bridge` verifies the gateway when it introspects by name. # Nothing in this container trusted the swarm CA, which is a runtime file no # build-time option can name — so an https call out of here could only ever diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix index df6f45f6..6c6d37f4 100644 --- a/nix/host-modules/swarm-grafana.nix +++ b/nix/host-modules/swarm-grafana.nix @@ -20,13 +20,15 @@ let networkCfg = config.services.hyperhive.network; hyperhiveCfg = config.services.hyperhive; gatewayCfg = hyperhiveCfg.gateway; - tlsCfg = deployCfg.hive-controller.tls; autheliaCfg = hyperhiveCfg.swarm.authelia; vmCfg = hyperhiveCfg.swarm.victoriametrics; vlCfg = hyperhiveCfg.swarm.victorialogs; swarmDomain = hyperhiveCfg.swarm.domain; - caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; }; + caTrust = import ./lib/hive-ca-trust.nix { + inherit lib gatewayCfg; + tlsCfg = deployCfg.hive-controller.tls; + }; # Spelled ONCE. The provisioned datasource declares it and every panel in the # provisioned dashboards references it; a second literal would be free to