vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: replace deprecated no-op options with mkRemovedOptionModule

Browse source
This commit is contained in:
müde 2026-07-13 21:58:30 +02:00
commit 7ad2bb9211
8 changed files with 85 additions and 189 deletions
Download patch file Download diff file Expand all files Collapse all files

74
nix/modules/hive-network.nix
View file

@ -33,28 +33,20 @@ in
# Always active when hyperhive is enabled: agent containers run in
# private netns behind the bridge. Full design: docs/network.md.
imports = [
(lib.mkRemovedOptionModule [ "services" "hyperhive" "network" "enable" ] ''
The hive network (bridge + dnsmasq resolver + private-netns
isolation) is always on whenever hyperhive is enabled. Remove the
setting.
'')
(lib.mkRemovedOptionModule [ "services" "hyperhive" "network" "isolateContainers" ] ''
Network isolation is the only mode and is always on whenever
hyperhive is enabled; the shared-netns path was removed. Remove
the setting.
'')
];
options.services.hyperhive.network = {
enable = lib.mkOption {
type = lib.types.bool;
default = config.services.hyperhive.enable;
defaultText = lib.literalExpression "config.services.hyperhive.enable";
example = false;
description = ''
**DEPRECATED — ignored.** The hive network (bridge + dnsmasq
resolver + private-netns isolation) is now always on whenever
hyperhive is enabled; setting this to `false` warns and has no
effect. Retained as a no-op so existing configs eval; will be
removed in a future release.
The network requires `services.hyperhive.domain` to be set — the
dnsmasq resolver is authoritative for `<hive-domain>` and its
sub-domains. A bridge interface (`bridgeName`) appears on the host
with `bridgeIp` assigned, the hive-gateway container runs a dnsmasq
on that IP, and each agent container runs in a private netns with a
veth pair on the bridge.
'';
};
bridgeName = lib.mkOption {
type = lib.types.str;
default = "hive-br0";
@ -168,26 +160,12 @@ in
'';
};
isolateContainers = lib.mkOption {
type = lib.types.bool;
default = true;
example = true;
description = ''
**DEPRECATED — ignored.** Network isolation is now the only mode and
is always on whenever hyperhive is enabled; the shared-netns path was
removed. This option is retained as a no-op so existing configs eval;
setting it to `false` warns and has no effect. It will be removed in
a future release.
'';
};
};
config = lib.mkMerge [
# The hive network + container isolation are unconditional whenever
# hyperhive is enabled: the shared-netns mode was removed, so there is
# one mode (private netns behind the bridge). `network.enable` and
# `isolateContainers` are kept as deprecated no-op options (see the
# warnings block below) so existing configs that set them still eval.
# hyperhive is enabled: the shared-netns mode was removed, so there
# is one mode (private netns behind the bridge).
(lib.mkIf config.services.hyperhive.enable {
assertions = [
{
@ -275,27 +253,5 @@ in
(lib.mkIf (config.services.hyperhive.enable && cfg.exposeHostPorts != [ ]) {
networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts = cfg.exposeHostPorts;
})
# Deprecation surface for the removed toggles. Both options are kept so
# existing configs that set them to `true` still eval cleanly; setting
# either to `false` no longer does anything (network + isolation are
# unconditional now), so warn rather than silently ignore.
{
# Only warn when hyperhive itself is enabled — otherwise `cfg.enable`
# defaults to `false` (tracking `hyperhive.enable`) and we'd fire a
# spurious deprecation warning on a host that doesn't run hyperhive.
warnings = lib.optionals config.services.hyperhive.enable (
lib.optional (!cfg.enable) ''
services.hyperhive.network.enable = false is deprecated and ignored
— the hive network is now always on (private-netns isolation is the
only mode). Remove the setting.
''
++ lib.optional (!cfg.isolateContainers) ''
services.hyperhive.network.isolateContainers = false is deprecated
and ignored — network isolation is now the only mode and is always
on. Remove the setting.
''
);
}
];
}