vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

swarm: extract the name guards, so the module just says what is forbidden

Browse source 
Her review: too much text, and an assertion helper instead of that much code
where the file should just say "this option cannot contain that".

`lib/name-guards.nix` gets `mustNotEqual` / `mustNotContain`; both call sites in
swarm-otel become four fields each — the option, the names, the list, and the
sentence explaining the failure. The message plumbing (find every offender,
quote them, name the list) is one shape shared by both.

Offenders are printed after their label rather than before it, because no
English verb agrees with both one name and five.

Converted the pre-existing equality assertion too. Leaving one hand-rolled
beside one helper-built is the worse of the two outcomes, and it is the same
guard.

Verified by evaluating both guards directly rather than only parsing: clean
rosters pass, `foo-agent`/`beehive` fail containment, `swarm` fails equality,
and `forgeworks`/`operator-hq` still pass — the control that keeps the two
lists from being merged.
This commit is contained in:
atlas 2026-08-31 18:30:19 +02:00 • committed by mara
commit 7172176b4c
3 changed files with 106 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

66
nix/host-modules/lib/name-guards.nix Normal file
View file

@ -0,0 +1,66 @@
# Assertions about names an operator chooses, so a module states WHAT is
# forbidden and not how to phrase the refusal.
{ lib }:
let
# One shape for both guards. Reports EVERY offender, not the first: fixing
# one per rebuild is the slowest possible way to learn a rule.
#
# Offenders come after their label rather than before it, so one name and
# five read the same — no English verb agrees with both.
guard =
{
option,
names,
forbidden,
hit,
problem,
forbiddenLabel,
why,
}:
let
offenders = lib.filter (n: lib.any (f: hit f n) forbidden) names;
quote = xs: lib.concatMapStringsSep ", " (x: "'${x}'") xs;
in
{
assertion = offenders == [ ];
message = ''
${option} ${problem}: ${quote offenders}
${forbiddenLabel}: ${quote forbidden}
${why}
'';
};
in
{
# No name may BE one of `reserved`.
mustNotEqual =
{
option,
names,
reserved,
why,
}:
guard {
inherit option names why;
forbidden = reserved;
hit = f: n: f == n;
problem = "has reserved name(s)";
forbiddenLabel = "Reserved";
};
# No name may CONTAIN one of `fragments`.
mustNotContain =
{
option,
names,
fragments,
why,
}:
guard {
inherit option names why;
forbidden = fragments;
hit = lib.hasInfix;
problem = "has name(s) containing a reserved word";
forbiddenLabel = "Forbidden as substrings";
};
}

96
nix/host-modules/swarm-otel.nix
View file

@ -72,14 +72,13 @@ let
# would be an eval error rather than a silently missing guard.
reservedOwners = import ../reserved-names.nix;
# The second, narrower blacklist: words no hive name may CONTAIN, because
# they are fixed segments of identifiers built FROM a hive name
# (`hive-<name>`, `hive-<name>-agent`). Substring rather than equality is
# the whole point — a hive called `foo-agent` collides in the composed
# string while colliding with nothing in the list above. That file explains
# why it is not merged into this one.
# Words no hive name may CONTAIN, because identifiers are composed from a
# hive name. That file explains why it is not merged into the list above.
reservedFragments = import ../reserved-hive-fragments.nix;
nameGuards = import ./lib/name-guards.nix { inherit lib; };
hiveNames = lib.attrNames hyperhiveCfg.swarm.hives;
# A published target is declared as ONE url, because that url is also the
# audience its token is minted for — but prometheus wants the same fact in
# three fields. Split it here rather than asking a service to state it
@ -666,71 +665,30 @@ in
Put it back, or give this module a different swarmTierName.
'';
}
{
# A hive whose name is one this module claims for itself collides in
# the collector's component namespace, and `//` resolves it silently:
# the swarm tier's parts win, that hive's `metrics/<name>` pipeline
# disappears, and its `resource/<name>` stamp goes with it — so the
# hive still connects and pushes into nothing, unlabelled.
#
# Checked rather than documented for the same reason the port range
# is: the names are all known at evaluation time, and the runtime
# symptom is a hive that looks healthy and reports no metrics, with
# nothing in any log naming the cause.
assertion = !lib.any (h: lib.elem h reservedOwners) (lib.attrNames hyperhiveCfg.swarm.hives);
message = ''
services.hyperhive.swarm.hives contains ${
lib.concatMapStringsSep ", " (h: "'${h}'") (
lib.filter (h: lib.elem h reservedOwners) (lib.attrNames hyperhiveCfg.swarm.hives)
)
}, which the swarm collector reserves for its own pipelines.
The collector names components `<kind>/<owner>` and uses the hive
name as the owner, so such a hive would silently replace the
swarm tier's parts and lose its own — it would keep accepting
pushes into a pipeline that routes nowhere.
Rename the hive. Reserved: ${lib.concatMapStringsSep ", " (n: "'${n}'") reservedOwners}.
(nameGuards.mustNotEqual {
option = "services.hyperhive.swarm.hives";
names = hiveNames;
reserved = reservedOwners;
why = ''
The collector names components `<kind>/<owner>` with the hive name
as owner, and `//` resolves the clash silently: the swarm tier's
parts win, that hive's pipeline and `hive=` stamp disappear, and it
keeps pushing into a route that goes nowhere. Rename the hive.
'';
}
{
# The substring half, and a genuinely different failure from the one
# above: these words are fixed SEGMENTS of identifiers composed from a
# hive name, so the collision is between two composed strings while
# the names themselves differ. `hive-foo-agent` is hive `foo-agent`'s
# own client id and hive `foo`'s AGENT client id at the same time; the
# queue's responder resolves it as the agents, so `foo-agent` silently
# receives an agent grant instead of its own — and a NATS denial
# reaches a client as a timeout, so nothing names the cause.
#
# Lives here rather than in `swarm-authelia.nix` (which composes those
# ids) because this module already owns the hive-roster check and a
# second site for "is this hive name legal" is how the two drift.
assertion =
!lib.any (h: lib.any (frag: lib.hasInfix frag h) reservedFragments) (
lib.attrNames hyperhiveCfg.swarm.hives
);
message = ''
services.hyperhive.swarm.hives contains ${
lib.concatMapStringsSep ", " (h: "'${h}'") (
lib.filter (h: lib.any (frag: lib.hasInfix frag h) reservedFragments) (
lib.attrNames hyperhiveCfg.swarm.hives
)
)
}, which CONTAIN a word the swarm composes identifiers from.
Hive-scoped identifiers are built by joining a hive name with these
words — `hive-<name>` for a hive, `hive-<name>-agent` for its agent
containers — so a name containing one produces an identifier that is
also somebody else's. The failure is a wrong grant, not an error:
the client authenticates and receives permissions meant for another
principal.
Rename the hive. Forbidden as substrings: ${
lib.concatMapStringsSep ", " (n: "'${n}'") reservedFragments
}.
})
(nameGuards.mustNotContain {
option = "services.hyperhive.swarm.hives";
names = hiveNames;
fragments = reservedFragments;
why = ''
Hive-scoped identifiers are composed from a hive name —
`hive-<name>`, `hive-<name>-agent` — so a name containing one of
these produces an identifier that is also somebody else's. The
failure is a wrong grant rather than an error: the client
authenticates and receives another principal's permissions, and a
NATS denial arrives as a timeout. Rename the hive.
'';
}
})
{
# A published target that is not an `https://host/path` url. Without
# this the split returns null and the failure surfaces as