vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

order the store's readers after its container without wanting it

Browse source
This commit is contained in:
atlas 2026-10-29 14:31:30 +01:00 • committed by mara
commit 868c57321c
6 changed files with 37 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/glue-bao-readers-store-order.nix
View file

@ -6,6 +6,12 @@
# log in to it, and nothing else. The waits on the store's policy units are
# ./glue-bao-readers-policy-order.nix's.
#
# No `Wants=` on the container: it is started by `machines.target` and the
# switch's start phase, and a reader's `Wants=` would pull it up mid-switch,
# before `activate` has replaced its configuration, on the OLD closure. A
# reader that starts before the store costs one failed attempt, retried by
# ./lib/store-retry.nix.
#
# `Wants=` on `swarm-bao-pki`, not `Requires=`: a pki start that fails or is
# refused fails each requirer's job with `dependency`, which leaves the reader
# inactive rather than failed, so its `Restart=on-failure` never fires. Here
@ -77,10 +83,7 @@ let
"swarm-bao-pki.service"
"container@${baoCfg.machine}.service"
];
wants = [
"swarm-bao-pki.service"
"container@${baoCfg.machine}.service"
];
wants = [ "swarm-bao-pki.service" ];
};
};
in

6
nix/host-modules/hive-priv-cache.nix
View file

@ -43,8 +43,8 @@ let
dir = "/run/hyperhive-priv/attic";
# Where the store runs on this host, its container is up before the first
# login attempt instead of failing against a store that is still starting.
# Where the store runs on this host, the first login waits for its container.
# No `wants`: a pull would start the container mid-switch on the old closure.
storeContainer = lib.optional baoDeploy.enable "container@${baoCfg.machine}.service";
storeRetry = import ./lib/store-retry.nix { };
@ -62,7 +62,7 @@ in
systemd.services.hive-priv-cache-facts = {
description = "Read the swarm cache's public key and pull token for hive-priv";
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ] ++ storeContainer;
wants = [ "network-online.target" ];
after = [
"network-online.target"
"systemd-tmpfiles-setup.service"

6
nix/host-modules/hive-squid-credential.nix
View file

@ -30,8 +30,8 @@ let
credentialFile = "/run/credstore/${hyperhiveCfg.deploy.hive-controller.squid.selfcheck.credentialName}";
# Where the store runs on this host, its container is up before the first
# login attempt instead of failing against a store that is still starting.
# Where the store runs on this host, the first login waits for its container.
# No `wants`: a pull would start the container mid-switch on the old closure.
storeContainer = lib.optional baoDeploy.enable "container@${baoCfg.machine}.service";
storeRetry = import ./lib/store-retry.nix { };
@ -43,7 +43,7 @@ in
description = "Read the squid self-check's password from the swarm secret store";
wantedBy = [ "multi-user.target" ];
before = [ "squid-selfcheck.service" ];
wants = [ "network-online.target" ] ++ storeContainer;
wants = [ "network-online.target" ];
after = [
"network-online.target"
"systemd-tmpfiles-setup.service"

2
nix/host-modules/hive-tls.nix
View file

@ -488,7 +488,6 @@ in
"swarm-bao-hive-leaf-policy.service"
"swarm-services-cert.service"
];
wants = [ "container@${baoCfg.machine}.service" ];
path = [
baoDeploy.package
pkgs.jq
@ -661,7 +660,6 @@ in
"swarm-bao-pki.service"
"swarm-bao-services-issuer-policy.service"
];
wants = [ "container@${baoCfg.machine}.service" ];
path = servicesCertPath;
# ./lib/store-retry.nix: the login below fails for as long as the
# store is sealed or down.

8
nix/host-modules/swarm-bao.nix
View file

@ -3122,11 +3122,9 @@ in
"swarm-bao-pki.service"
"container@${cfg.machine}.service"
];
# `Wants=` pki, for ./glue-bao-readers-store-order.nix's reason.
wants = [
"swarm-bao-pki.service"
"container@${cfg.machine}.service"
];
# `Wants=` pki and none on the container, for
# ./glue-bao-readers-store-order.nix's reasons.
wants = [ "swarm-bao-pki.service" ];
wantedBy = [ "multi-user.target" ];
path = [
baoDeploy.package

1
nix/host-modules/swarm-nats.nix
View file

@ -1183,7 +1183,6 @@ in
"container@${baoCfg.machine}.service"
"swarm-bao-pki.service"
];
wants = [ "container@${baoCfg.machine}.service" ];
path = [
baoDeploy.package
pkgs.jq