vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

glue: consumers' start-after-bao ordering moves into one glue module

Browse source 
Each store reader (forge's OIDC fetch and token publisher, matrix's OIDC
fetch, the hive collector's fetch, Grafana's OIDC fetch and admin password,
the queue's callout-xkey unit, the CI runner's token fetch, the swarm
collector's OIDC fetch) used to read `deploy.bao.enable` in its own module
to add `after`/`wants` on `container@<store machine>` and
`after`/`requires` on `swarm-bao-pki.service`. Per the #3742 ruling, that
cross-service read moves into glue-bao-readers-store-order.nix, which sets
the same edges when the store and the reader are both on this host and
restates each reader's own gate so no stub unit is rendered.

Rendered `after`/`wants`/`requires` are identical as sets to main on 16
fixtures, store here and elsewhere. New module-eval cases in existing
fixtures pin both arms.

Part of #3742.
This commit is contained in:
atlas 2026-10-13 09:38:33 +02:00 • committed by mara
commit 9407db69b5
13 changed files with 198 additions and 76 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nix/module-eval/forge-placement.nix
View file

@ -187,6 +187,21 @@ let
ciAlone.systemd.services.swarm-bao-ci-runner.environment.BAO_CLIENT_CERT
== "/etc/pki/bao-ci-runner.pem";
}
{
# The store's units exist only on its host; `Requires=` on an absent one
# fails the fetch's start. The arm where the store is here is in
# ./swarm-services-switch.nix.
name = "the CI runner's token fetch names none of the store's units on a host without the store";
ok =
let
u = ciAlone.systemd.services.swarm-bao-ci-runner;
storeUnits = [
"swarm-bao-pki.service"
"container@${ciAlone.services.hyperhive.swarm.bao.machine}.service"
];
in
!(lib.any (n: lib.elem n (u.after ++ u.wants ++ u.requires)) storeUnits);
}
{
# Without the identity the token never arrives; the control is the
# placed pair above.

20
nix/module-eval/hive-otel.nix
View file

@ -278,6 +278,26 @@ let
in
lib.hasInfix "bao kv get -field=value ${path}" fetch && lib.hasInfix "bao kv put ${path} " publish;
}
{
# The store's units exist only on its host; `Requires=` on an absent one
# fails the fetch's start.
name = "the hive collector's fetch waits for the store's container and PKI unit only where the store runs here";
ok =
let
storeUnits = m: [
"swarm-bao-pki.service"
"container@${m.services.hyperhive.swarm.bao.machine}.service"
];
here = hiveOtelFetch hiveOtelAllLocal;
elsewhere = hiveOtelFetch hiveOtelLeaf;
in
lib.all (n: lib.elem n here.after) (storeUnits hiveOtelAllLocal)
&& lib.elem "swarm-bao-pki.service" here.requires
&& lib.elem "container@${hiveOtelAllLocal.services.hyperhive.swarm.bao.machine}.service" here.wants
&& !(lib.any (n: lib.elem n (elsewhere.after ++ elsewhere.wants ++ elsewhere.requires)) (
storeUnits hiveOtelLeaf
));
}
{
# A secret delivered some other way is the operator's: no unit fetches
# into a file the collector does not load, or restarts it on one. Nothing

15
nix/module-eval/swarm-otel-identity.nix
View file

@ -217,6 +217,21 @@ let
!(refusedOver otelReaderNamedInFull "otelOidcClientCertFile")
&& !(refusedOver otelRemoteAuthelia "otelOidcClientCertFile");
}
{
# The store's units exist only on its host; `Requires=` on an absent one
# fails the fetch's start. The arm where the store is here is in
# ./swarm-services-switch.nix.
name = "the remote reader's fetch names none of the store's units";
ok =
let
u = otelReaderNamedInFull.systemd.services.swarm-bao-otel-oidc;
storeUnits = [
"swarm-bao-pki.service"
"container@${otelReaderNamedInFull.services.hyperhive.swarm.bao.machine}.service"
];
in
!(lib.any (n: lib.elem n (u.after ++ u.wants ++ u.requires)) storeUnits);
}
];
in
runGroup "swarm-otel-identity" cases

48
nix/module-eval/swarm-services-switch.nix
View file

@ -575,6 +575,54 @@ let
== "/etc/marker-avatar.png"
&& !(controllerWithMirrors.systemd.services.hive-c0re.environment ? HIVE_ORG_AVATAR_PNG);
}
{
# Where the store runs here, each reader waits for its container and
# requires the PKI unit minting the leaf it logs in with. Elsewhere
# neither unit exists, and `Requires=` on an absent unit fails the
# reader's start. On the store's host without the readers, none of them
# is rendered as a stub. Rosters are counted: an empty one holds
# vacuously.
name = "a store reader waits for the store's container and PKI unit only where the store runs here";
ok =
let
machine = serviceContainersWithCi.services.hyperhive.swarm.bao.machine;
storeUnits = [
"swarm-bao-pki.service"
"container@${machine}.service"
];
readers = [
"swarm-bao-forge-oidc"
"swarm-bao-forge-publisher"
"swarm-bao-matrix-oidc"
"swarm-bao-hive-otel-oidc"
"swarm-bao-grafana-oidc"
"swarm-bao-grafana-admin"
"swarm-bao-nats-callout-xkey"
"swarm-bao-ci-runner"
"swarm-bao-otel-oidc"
];
here = serviceContainersWithCi.systemd.services;
elsewhere = swarmServicesBaoElsewhere.systemd.services;
readersElsewhere = lib.filter (u: elsewhere ? ${u}) readers;
waits =
u:
here ? ${u}
&& lib.elem "swarm-bao-pki.service" here.${u}.after
&& lib.elem "swarm-bao-pki.service" here.${u}.requires
&& lib.elem "container@${machine}.service" here.${u}.after
&& lib.elem "container@${machine}.service" here.${u}.wants;
namesNoStoreUnit =
u:
let
s = elsewhere.${u};
in
!(lib.any (n: lib.elem n (s.after ++ s.wants ++ s.requires)) storeUnits);
in
lib.all waits readers
&& lib.length readersElsewhere == 6
&& lib.all namesNoStoreUnit readersElsewhere
&& !(lib.any (u: storeOnlyNoHive.systemd.services ? ${u}) readers);
}
];
in
runGroup "swarm-services-switch" cases