vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

glue-matrix-bao-token: state the bound the comment claims

Browse source 
The comment said it bounds the wait rather than hanging the boot, and
nothing in the unit bounded anything. What actually held was systemd's
default start timeout plus the homeserver only Wants= this unit — both
true, neither stated here, so a reader had to already know them.

TimeoutStartSec puts the number a boot waits on in the file that waits,
and the comment now names the degradation: hitting it keeps the locally
minted token, same as every other failure path in this unit.

Caught by argus reviewing the slice it shipped in.
This commit is contained in:
atlas 2026-08-30 19:10:48 +02:00
commit 8371e1ca62
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nix/host-modules/glue-matrix-bao-token.nix
View file

@ -70,6 +70,10 @@ in
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
# What actually bounds the read below. Stated here rather than
# left to systemd's default, so the number a boot waits on is in
# the file that waits.
TimeoutStartSec = 30;
}; };
environment = { environment = {
BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}"; BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
@ -80,9 +84,11 @@ in
script = '' script = ''
set -euo pipefail set -euo pipefail
# A sealed or uninitialised store answers on the port and times out on # A sealed or uninitialised store answers on the port and never
# every read, so "the store is up" is not the same as "the store can # answers the read, so "the store is up" is not the same as "the
# answer" -- bound the wait rather than hanging the boot behind it. # store can answer". `TimeoutStartSec` above is the bound; the
# homeserver only `Wants=` this unit, so hitting it degrades to
# keeping the local token rather than holding up the container.
if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then
echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2 echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2
echo "Keeping the token hive-matrix already has." >&2 echo "Keeping the token hive-matrix already has." >&2