vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs(3191): drop the migration history from the gateway comments

Browse source 
Per mara on the PR: how a thing used to be deployed stops being
relevant the moment this is merged and the hives are rebuilt, so the
comments state the current constraint and nothing about the container
that used to hold it.

Removes the two ⚠️ blocks this PR added (hive-tls-ca's ordering, the
resign propagation), the matrix ordering's, dnsmasq's resolv.conf
paragraph, and the pre-existing 'REMOVED WITH THE CONTAINER' inventory
in the gateway module. The 🚨 do-not-simplify warning on the cert-copy
unit keeps both its reasons and loses the container framing.

Kept deliberately: the two operator-facing 'this used to default to
true' option notes (migration information for someone upgrading), and
the SupplementaryGroups block, which documents why an absence is
load-bearing rather than how a deployment used to look.
This commit is contained in:
atlas 2026-08-12 13:26:58 +02:00
commit b12be26f20
4 changed files with 11 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/hive-tls.nix
View file

@ -316,15 +316,8 @@ in
# The consumer is `hive-gateway-self-signed-cert`, which copies the
# leaf into the gateway's state dir at the mode nginx can read, and
# which nginx in turn `Requires=`. So this must run first or that
# copy fails under `set -eu` and takes nginx down with it.
#
# ⚠️ This used to name `container@hive-gateway.service` — ordering
# ran through the container, because the copy happened *at container
# start*. Moving the gateway onto the host retired the container
# without retiring the dependency: both units became plain host
# units with nothing sequencing them, and the copy could win the
# race on a fast disk. Order against the unit that reads the file,
# not against the thing that used to host it.
# copy fails under `set -eu` and takes nginx down with it — order
# against the unit that reads the file.
before = [ "hive-gateway-self-signed-cert.service" ];
requiredBy = [ "hive-gateway-self-signed-cert.service" ];
# The issuance below needs the swarm root key on disk, and (for the
@ -482,16 +475,10 @@ in
# the source therefore changes nothing on its own — the copy has to be
# remade and nginx reloaded, which is what the two calls below do.
#
# ⚠️ Both calls used to be `systemctl -M hive-gateway … || true`, from
# when nginx lived in a container: `-M` entered the machine, and the
# `|| true` covered a *stopped* container, which was a normal state
# ("its next boot imports the rotated leaf anyway"). The container is
# gone, so `-M hive-gateway` names a machine nothing creates — both
# calls failed, both failures were swallowed, and the unit logged
# "propagating" and exited 0 while nginx kept serving the stale copy
# until it expired. A host unit failing is NOT a normal state: no
# `-M`, and no `|| true` either, so a broken propagation fails the
# timer loudly instead of reporting success.
# ⚠️ Neither call is `|| true`: a swallowed propagation failure means
# the leaf rotates on disk while nginx keeps serving the old copy
# until it expires, with this unit reporting success the whole time.
# A failure here must fail the timer.
systemd.services.hive-tls-resign = {
description = "Re-sign the gateway TLS leaf and reload nginx";
# hive-tls-ca must have run first so the CA key exists before we try