vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs: sweep archaeology comments to present state

Browse source
This commit is contained in:
müde 2026-07-13 22:16:02 +02:00
commit 79fec131d6
4 changed files with 9 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/agent-modules/matrix.nix
View file

@ -169,7 +169,7 @@ in
# Token files must land at the `matrix-token*` name the daemon # Token files must land at the `matrix-token*` name the daemon
# path-watcher globs (`/agents/*/state/matrix-token*`), or the account # path-watcher globs (`/agents/*/state/matrix-token*`), or the account
# never gets picked up live (it loads only on a full daemon restart). # never gets picked up live (it loads only on a full daemon restart).
# Enforce the basename prefix so a deviating name (e.g. the historical # Enforce the basename prefix so a deviating name (e.g.
# `matrix-catgirl-token`) is caught at build time, not silently. # `matrix-catgirl-token`) is caught at build time, not silently.
{ {
assertion = lib.all (a: lib.hasPrefix "matrix-token" (baseNameOf a.tokenFile)) ( assertion = lib.all (a: lib.hasPrefix "matrix-token" (baseNameOf a.tokenFile)) (

8
nix/host-modules/hive-ci.nix
View file

@ -127,10 +127,10 @@ let
fi fi
CORE_TOKEN=$(cat ${coreTokenPath}) CORE_TOKEN=$(cat ${coreTokenPath})
# Capture the HTTP status so a stale/invalid core token (401/403) is # Capture the HTTP status so a stale/invalid core token (401/403) is
# distinguished from a transient forge hiccup. With the old bare # distinguished from a transient forge hiccup. A bare
# `curl -sf | jq`, a forge-core-token that's stale for the current # `curl -sf | jq` would let a forge-core-token that is stale for
# forge (e.g. after a forge rebuild) 401s and fails silently every # the current forge (e.g. after a forge rebuild) 401 silently on
# attempt for the full 60s loop, then exits with a misleading # every attempt for the full 60s loop and exit with a misleading
# "core token absent or forge unreachable" — masking the real cause. # "core token absent or forge unreachable" — masking the real cause.
# Fail fast + loudly on 401/403 so the failure mode is legible and # Fail fast + loudly on 401/403 so the failure mode is legible and
# the operator/hive-c0re knows to re-mint forge-core-token. # the operator/hive-c0re knows to re-mint forge-core-token.

5
nix/host-modules/hive-tls.nix
View file

@ -191,9 +191,8 @@ in
# container start). A host-side `systemctl -M hive-gateway` call # container start). A host-side `systemctl -M hive-gateway` call
# triggers the re-import + reload, mirroring how hive-c0re reloads the # triggers the re-import + reload, mirroring how hive-c0re reloads the
# gateway after each agents.conf write. A path unit *inside* the # gateway after each agents.conf write. A path unit *inside* the
# container was tried first but does not work: IN_MOVED_TO from an # container cannot do this: IN_MOVED_TO from an atomic rename on the
# atomic rename on the host does not propagate across the nspawn # host does not propagate across the nspawn mount-namespace boundary.
# mount-namespace boundary.
# #
# `|| true` on propagation so a stopped gateway never fails the unit — # `|| true` on propagation so a stopped gateway never fails the unit —
# its next boot will import the already-rotated leaf anyway. # its next boot will import the already-rotated leaf anyway.

4
nix/host-modules/swarm.nix
View file

@ -184,8 +184,8 @@
}; };
}; };
# Gated on the c0re daemon being enabled (the historical shape — the # Gated on the c0re daemon being enabled — the mesh is part of the
# mesh is part of the coordinator host's networking). # coordinator host's networking.
config = lib.mkIf config.services.hyperhive.c0re.enable { config = lib.mkIf config.services.hyperhive.c0re.enable {
assertions = lib.optionals config.services.hyperhive.swarm.wireguard.enable [ assertions = lib.optionals config.services.hyperhive.swarm.wireguard.enable [
{ {