From 8371e1ca620df197cb2d628a6773da4c62f32cd1 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 30 Aug 2026 19:10:48 +0200 Subject: [PATCH] glue-matrix-bao-token: state the bound the comment claims MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment said it bounds the wait rather than hanging the boot, and nothing in the unit bounded anything. What actually held was systemd's default start timeout plus the homeserver only Wants= this unit — both true, neither stated here, so a reader had to already know them. TimeoutStartSec puts the number a boot waits on in the file that waits, and the comment now names the degradation: hitting it keeps the locally minted token, same as every other failure path in this unit. Caught by argus reviewing the slice it shipped in. --- nix/host-modules/glue-matrix-bao-token.nix | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/nix/host-modules/glue-matrix-bao-token.nix b/nix/host-modules/glue-matrix-bao-token.nix index a89db5b3..fbc703b4 100644 --- a/nix/host-modules/glue-matrix-bao-token.nix +++ b/nix/host-modules/glue-matrix-bao-token.nix @@ -70,6 +70,10 @@ in serviceConfig = { Type = "oneshot"; RemainAfterExit = true; + # What actually bounds the read below. Stated here rather than + # left to systemd's default, so the number a boot waits on is in + # the file that waits. + TimeoutStartSec = 30; }; environment = { BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}"; @@ -80,9 +84,11 @@ in script = '' set -euo pipefail - # A sealed or uninitialised store answers on the port and times out on - # every read, so "the store is up" is not the same as "the store can - # answer" -- bound the wait rather than hanging the boot behind it. + # A sealed or uninitialised store answers on the port and never + # answers the read, so "the store is up" is not the same as "the + # store can answer". `TimeoutStartSec` above is the bound; the + # homeserver only `Wants=` this unit, so hitting it degrades to + # keeping the local token rather than holding up the container. if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2 echo "Keeping the token hive-matrix already has." >&2