vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

refuse an agentNatsUrl that hive-priv would reject at container start

Browse source 
on deploy, deploy.hive-controller.queue.agentNatsUrl must be one
scheme://host:port; an IPv6 literal or a comma list now fails at evaluation
instead of failing every container start.
This commit is contained in:
atlas 2026-10-24 19:20:37 +02:00
commit 6dd9d0086e
3 changed files with 27 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/swarm.nix
View file

@ -477,7 +477,7 @@ in
# Only the address lives here. Each agent reads its own credential from the
# store (`nix/agent-modules/queue-identity.nix`).
options.services.hyperhive.deploy.hive-controller.queue.agentNatsUrl = lib.mkOption {
type = lib.types.nullOr lib.types.str;
type = lib.types.nullOr (lib.types.strMatching "[a-z]{1,10}://[A-Za-z0-9._-]{1,200}:[0-9]{1,5}");
default = "tls://${swarmCfg.nats.domain}:${toString swarmCfg.nats.port}";
defaultText = lib.literalExpression ''"tls://''${swarm.nats.domain}:''${swarm.nats.port}"'';
example = "tls://nats.example.com:4222";
@ -492,6 +492,10 @@ in
agent's network namespace `127.0.0.1` is the agent, not this host,
and the queue's certificate names no address anyway.
One `<scheme>://<host>:<port>`: a hostname or IPv4 address, no IPv6 literal and no
list. The value reaches the container as `HIVE_AGENT_NATS_URL`, whose
character set hive-priv enforces at container start.
Null means this hive's agents have not been given the queue's address,
and the harness is handed none.
'';