vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

containers reach network-online only with a dhcp lease, and bao users wait for it

Browse source
This commit is contained in:
atlas 2026-11-01 11:06:41 +01:00
commit 81a57a9f81
3 changed files with 77 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

24
nix/module-eval/agent-queue-bao.nix
View file

@ -223,6 +223,30 @@ let
in
lib.hasInfix "bao kv get -format=json ${arg} >\"$raw\"" (agentBaoIdentity m).script;
}
{
# dhcpcd without IPv4LL waiting for IPv4 makes `network-online` a lease,
# and the two units that dial the store at start order after it. The
# trust bundle's order after the identity check and `nohook` are the
# controls that the lookups find something.
name = "an agent reaches network-online only with a lease, and its store identity and trust bundle wait for it";
ok =
let
d = agentBao.networking.dhcpcd;
after = n: agentBao.systemd.services.${n}.after;
wants = n: agentBao.systemd.services.${n}.wants;
units = [
"hive-agent-bao-identity"
"hive-agent-trust-bundle"
];
in
lib.hasInfix "noipv4ll" d.extraConfig
&& lib.hasInfix "nohook resolv.conf" d.extraConfig
&& d.wait == "ipv4"
&& lib.elem "hive-agent-bao-identity.service" (after "hive-agent-trust-bundle")
&& lib.all (
n: lib.elem "network-online.target" (after n) && lib.elem "network-online.target" (wants n)
) units;
}
{
# The absence arm, and what makes the four above able to fail. An agent
# whose swarm never minted an identity has nothing to log in with, and a

2
nix/module-eval/bao-matrix-reader.nix
View file

@ -276,6 +276,8 @@ let
in
lib.elem "tuwunel.service" r.before
&& lib.elem "tuwunel.service" r.wantedBy
&& lib.elem "network-online.target" r.after
&& lib.elem "network-online.target" r.wants
&& !(lib.elem "tuwunel.service" (r.requiredBy or [ ]))
&&
baoWithMatrix.containers.hive-matrix.config.systemd.services.tuwunel.serviceConfig.Restart

25
nix/module-eval/swarm-services-switch.nix
View file

@ -295,6 +295,31 @@ let
&& !(sc.DynamicUser or false)
&& swarmServicesHere.services.hyperhive.deploy.nats.enable;
}
{
# dhcpcd without IPv4LL, waiting for IPv4: `network-online` is a lease.
# The router sets no `nohook` itself and authelia does; `nohook` is the
# control that the lookup finds `extraConfig`. The queue shares the host
# netns and keeps the default.
name = "private-netns service containers wait for a DHCP lease and the forwarder fetch waits for it";
ok =
let
cfgOf = name: swarmServicesHere.containers.${name}.config;
leased =
name:
let
d = (cfgOf name).networking.dhcpcd;
in
lib.hasInfix "noipv4ll" d.extraConfig && d.wait == "ipv4";
fetch = (cfgOf "swarm-builder").systemd.services.swarm-journal-forwarder-oidc;
in
leased "swarm-notify-router"
&& leased "swarm-authelia"
&& lib.hasInfix "nohook resolv.conf" (cfgOf "swarm-authelia").networking.dhcpcd.extraConfig
&& !(lib.hasInfix "noipv4ll" (cfgOf "swarm-nats").networking.dhcpcd.extraConfig)
&& (cfgOf "swarm-nats").networking.dhcpcd.wait == "any"
&& lib.elem "network-online.target" fetch.after
&& lib.elem "network-online.target" fetch.wants;
}
{
name = "the notification router stays off where the shared services are hosted without the store";
ok =