vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

order the store's readers after its container without wanting it

Browse source
This commit is contained in:
atlas 2026-10-29 14:31:30 +01:00 • committed by mara
commit 868c57321c
3 changed files with 37 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/module-eval/hive-otel.nix
View file

@ -365,6 +365,8 @@ let
{
# The store's units exist only on its host. The PKI unit is wanted, never
# required: a refused pki start fails a requirer's job with `dependency`.
# The container is waited for, not wanted: a `Wants=` would start it
# mid-switch on the old closure.
name = "the hive collector's fetch waits for the store's container and PKI unit only where the store runs here";
ok =
let
@ -378,7 +380,7 @@ let
lib.all (n: lib.elem n here.after) (storeUnits hiveOtelAllLocal)
&& lib.elem "swarm-bao-pki.service" here.wants
&& !(lib.elem "swarm-bao-pki.service" here.requires)
&& lib.elem "container@${hiveOtelAllLocal.services.hyperhive.swarm.bao.machine}.service" here.wants
&& !(lib.elem "container@${hiveOtelAllLocal.services.hyperhive.swarm.bao.machine}.service" here.wants)
&& !(lib.any (n: lib.elem n (elsewhere.after ++ elsewhere.wants ++ elsewhere.requires)) (
storeUnits hiveOtelLeaf
));

18
nix/module-eval/hive-tls.nix
View file

@ -824,19 +824,27 @@ let
}
{
# Both units log in to the store, so where its container runs here they
# start after it. Controls: the units exist on `noService`, which reads
# a store it does not run, and carry no container there.
name = "the cache-facts and squid credential units wait for the store's container only where it runs here";
# start after it, and none of the store's readers wants it: a `Wants=`
# would start it mid-switch on the old closure. Controls: the units exist
# on `noService`, which reads a store it does not run, and carry no
# container there.
name = "the cache-facts and squid credential units wait for the store's container, without wanting it, only where it runs here";
ok =
let
ref = "container@swarm-bao.service";
waits = u: lib.elem ref u.after && lib.elem ref u.wants;
waits = u: lib.elem ref u.after && !(lib.elem ref u.wants);
names = [
"hive-priv-cache-facts"
"squid-selfcheck-credential"
];
in
lib.all (n: waits allLocal.systemd.services.${n}) names
lib.all (n: waits allLocal.systemd.services.${n}) (
names
++ [
"hive-tls-resign"
"swarm-services-cert"
]
)
&& lib.all (
n:
noService.systemd.services ? ${n}

9
nix/module-eval/swarm-services-switch.nix
View file

@ -1239,13 +1239,14 @@ let
}
{
# Where the store runs here, each reader waits for its container and
# the PKI unit minting the leaf it logs in with, and wants both. It
# never requires the PKI unit: a refused pki start fails a requirer's
# the PKI unit minting the leaf it logs in with, and wants the PKI unit only:
# a `Wants=` on the container would start it mid-switch on the old closure.
# It never requires the PKI unit: a refused pki start fails a requirer's
# job with `dependency`, which its `Restart=on-failure` never retries.
# Elsewhere neither unit exists. On the store's host without the
# readers, none of them is rendered as a stub. Rosters are counted: an
# empty one holds vacuously.
name = "a store reader waits for and wants the store's container and PKI unit only where the store runs here, and requires neither";
name = "a store reader waits for the store's container and PKI unit only where the store runs here, wants only the PKI unit, and requires neither";
ok =
let
machine = serviceContainersWithCi.services.hyperhive.swarm.bao.machine;
@ -1276,7 +1277,7 @@ let
&& lib.elem "swarm-bao-pki.service" here.${u}.wants
&& !(lib.any (n: lib.elem n here.${u}.requires) storeUnits)
&& lib.elem "container@${machine}.service" here.${u}.after
&& lib.elem "container@${machine}.service" here.${u}.wants;
&& !(lib.elem "container@${machine}.service" here.${u}.wants);
namesNoStoreUnit =
u:
let