vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move links, adminSync.ignoreUsers and scrapeTargets under their service's deploy namespace

Browse source
This commit is contained in:
atlas 2026-11-01 20:34:50 +01:00
commit 90272ec3c0
7 changed files with 156 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/module-eval/bao-controller.nix
View file

@ -62,7 +62,7 @@ let
controllerPinnedMatrix = hive {
deploy.swarm-controller.enable = true;
swarm.matrix.gatewayHost = "matrix.hive.t.local";
swarm.matrix.adminSync.ignoreUsers = [
deploy.swarm-controller.matrixAdminSync.ignoreUsers = [
"@keep-a:t.local"
"@keep-b:t.local"
];

35
nix/module-eval/core-toggle.nix
View file

@ -1594,6 +1594,15 @@ let
victorialogs.port = 19428;
forge.httpPort = 13000;
matrix.allowEncryption = true;
controller.links = [
{
label = "Legacy";
icon = "L";
url = "https://legacy.example/";
}
];
matrix.adminSync.ignoreUsers = [ "@legacy:t.local" ];
otel.scrapeTargets.legacy = "127.0.0.1:9777";
};
};
d = old.services.hyperhive.deploy;
@ -1623,6 +1632,19 @@ let
&& d.forgejo.httpPort == 13000
&& d.matrix.allowEncryption
&& d.builder.nixpkgsFlake == "path:/legacy/nixpkgs"
&& lib.any (l: l.label == "Legacy" && l.url == "https://legacy.example/") d.swarm-controller.links
&& lib.any (l: l.label == "Legacy") (
builtins.fromJSON old.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_LINKS
)
&& d.swarm-controller.matrixAdminSync.ignoreUsers == [ "@legacy:t.local" ]
&&
old.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_MATRIX_ADMIN_SYNC_IGNORE_USERS
== "@legacy:t.local"
&& d.swarm-otel.scrapeTargets.legacy == "127.0.0.1:9777"
&&
(lib.findFirst (j: j.job_name == "legacy") null (
(otelSettings old).receivers.prometheus.config.scrape_configs
)).static_configs == [ { targets = [ "127.0.0.1:9777" ]; } ]
&&
old.containers.swarm-builder.config.systemd.services.swarm-builder.environment.SWARM_BUILDER_NIXPKGS_FLAKE
== "path:/legacy/nixpkgs"
@ -1642,6 +1664,9 @@ let
"swarm.forge.httpPort"
"swarm.matrix.allowEncryption"
"c0re.nixpkgsFlake"
"swarm.controller.links"
"swarm.matrix.adminSync.ignoreUsers"
"swarm.otel.scrapeTargets"
]
&& !(lib.any (w: lib.hasInfix "swarm.controller.queue" w) allLocal.warnings)
&& refused old "deploy.nats.otel.telemetryPort"
@ -1672,7 +1697,15 @@ let
&& (locs h.swarm.nats.domain)."= /metrics".proxyPass == "http://127.0.0.1:7777/metrics"
&& (locs h.swarm.victorialogs.domain)."= /metrics".proxyPass == "http://127.0.0.1:9428/metrics"
&& (locs h.swarm.forge.domain)."/".proxyPass == "http://127.0.0.1:3000/"
&& !allLocal.containers.hive-matrix.config.services.matrix-tuwunel.settings.global.allow_encryption;
&& !allLocal.containers.hive-matrix.config.services.matrix-tuwunel.settings.global.allow_encryption
&& env.SWARM_CONTROLLER_MATRIX_ADMIN_SYNC_IGNORE_USERS == ""
&& lib.any (l: l.label == "Forge" && l.url == "https://${h.swarm.forge.domain}/") (
builtins.fromJSON env.SWARM_CONTROLLER_LINKS
)
&&
(lib.findFirst (j: j.job_name == "collector") null (
(otelSettings allLocal).receivers.prometheus.config.scrape_configs
)).static_configs == [ { targets = [ "127.0.0.1:8889" ]; } ];
}
{
# Each old spelling lands on the new path, with its own rename warning;

2
nix/module-eval/forge-placement.nix
View file

@ -127,7 +127,7 @@ let
name = "a host running the collector, authelia, grafana and nats scrapes none of them on loopback";
ok =
let
t = servicesHere.services.hyperhive.swarm.otel.scrapeTargets;
t = servicesHere.services.hyperhive.deploy.swarm-otel.scrapeTargets;
in
servicesHere.services.hyperhive.deploy.nats.enable
&& !(t ? authelia)

4
nix/module-eval/nats-authelia.nix
View file

@ -300,8 +300,8 @@ let
name = "authelia and nats declare no scrape target on a host with no collector";
ok =
!(autheliaAndNats.services.hyperhive.deploy.swarm-otel.enable)
&& !(autheliaAndNats.services.hyperhive.swarm.otel.scrapeTargets ? authelia)
&& !(autheliaAndNats.services.hyperhive.swarm.otel.scrapeTargets ? nats);
&& !(autheliaAndNats.services.hyperhive.deploy.swarm-otel.scrapeTargets ? authelia)
&& !(autheliaAndNats.services.hyperhive.deploy.swarm-otel.scrapeTargets ? nats);
}
{
# The xkey and the responder's OIDC client secret are read only from

2
nix/module-eval/shared.nix
View file

@ -100,7 +100,7 @@ in
baoWithCollector = hive {
deploy.bao.enable = true;
deploy.swarm-otel.enable = true;
swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
deploy.swarm-otel.scrapeTargets.plain = "127.0.0.1:9999";
};
# `clientSecretFile` is what ../host-modules/otel.nix's identity assertion

4
nix/module-eval/swarm-otel-identity.nix
View file

@ -81,7 +81,7 @@ let
# is a running collector with no self-scrape, not an absent one.
otelOnlyPublished = hive {
deploy.swarm-otel.enable = true;
swarm.otel.scrapeTargets = lib.mkForce { };
deploy.swarm-otel.scrapeTargets = lib.mkForce { };
swarm.otel.publishedScrapeTargets.remote = "https://remote.t.local/metrics";
};
@ -175,7 +175,7 @@ let
let
s = otelSettings otelOnlyPublished;
in
otelOnlyPublished.services.hyperhive.swarm.otel.scrapeTargets == { }
otelOnlyPublished.services.hyperhive.deploy.swarm-otel.scrapeTargets == { }
&& otelOnlyPublished.services.hyperhive.swarm.otel.publishedScrapeTargets != { }
&& (s.receivers ? prometheus)
&& builtins.elem "prometheus" s.service.pipelines."metrics/swarm".receivers;

4
nix/module-eval/swarm-services-switch.nix
View file

@ -167,7 +167,9 @@ let
};
swarmServiceLinksOf =
cfg:
lib.filter (l: swarmServiceLinkDomains ? ${l.label}) cfg.services.hyperhive.swarm.controller.links;
lib.filter (
l: swarmServiceLinkDomains ? ${l.label}
) cfg.services.hyperhive.deploy.swarm-controller.links;
# Every service container at once: the services-only host plus the CI
# runner. The CI runner, the review classifier, the notification router, the