vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

glue: consumers' start-after-bao ordering moves into one glue module

Browse source 
Each store reader (forge's OIDC fetch and token publisher, matrix's OIDC
fetch, the hive collector's fetch, Grafana's OIDC fetch and admin password,
the queue's callout-xkey unit, the CI runner's token fetch, the swarm
collector's OIDC fetch) used to read `deploy.bao.enable` in its own module
to add `after`/`wants` on `container@<store machine>` and
`after`/`requires` on `swarm-bao-pki.service`. Per the #3742 ruling, that
cross-service read moves into glue-bao-readers-store-order.nix, which sets
the same edges when the store and the reader are both on this host and
restates each reader's own gate so no stub unit is rendered.

Rendered `after`/`wants`/`requires` are identical as sets to main on 16
fixtures, store here and elsewhere. New module-eval cases in existing
fixtures pin both arms.

Part of #3742.
This commit is contained in:
atlas 2026-10-13 09:38:33 +02:00 • committed by mara
commit 9407db69b5
13 changed files with 198 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nix/host-modules/otel.nix
View file

@ -337,6 +337,7 @@ in
# Only when the collector reads the file the unit writes: a secret
# delivered some other way is the operator's, and a unit restarting the
# collector on a file it never loads would be noise.
# ./glue-bao-readers-store-order.nix restates this gate.
fetches = senderAuth && hiveLeaf && otel.clientSecretFile == fetchedSecretPath;
# An operator-delivered file has no unit that restarts the collector
# once it lands, so the collector waits for it instead.
@ -793,15 +794,9 @@ in
# secret reaches it only by a restart, which `refresh_unit` does.
systemd.services.${fetchUnit} = lib.mkIf fetches {
description = "fetch this hive's telemetry OIDC client secret from the swarm secret store";
# The store's units exist only where the store runs; `Requires=` on an
# absent unit fails the job, so off-host the timeout below bounds the
# attempt instead.
after = lib.optionals deployCfg.bao.enable [
"swarm-bao-pki.service"
"container@${baoCfg.machine}.service"
];
wants = lib.optionals deployCfg.bao.enable [ "container@${baoCfg.machine}.service" ];
requires = lib.optionals deployCfg.bao.enable [ "swarm-bao-pki.service" ];
# Ordered after the store where it runs here
# (./glue-bao-readers-store-order.nix, which restates `fetches`);
# elsewhere the timeout below bounds the attempt.
before = [ "opentelemetry-collector.service" ];
wantedBy = [
"multi-user.target"