vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

let the store container's cold start finish, and order its readers after it

Browse source
This commit is contained in:
atlas 2026-10-29 13:05:47 +01:00 • committed by mara
commit b1c828dbf8
4 changed files with 48 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/host-modules/hive-priv-cache.nix
View file

@ -43,6 +43,10 @@ let
dir = "/run/hyperhive-priv/attic";
# Where the store runs on this host, its container is up before the first
# login attempt instead of failing against a store that is still starting.
storeContainer = lib.optional baoDeploy.enable "container@${baoCfg.machine}.service";
storeRetry = import ./lib/store-retry.nix { };
storeRefreshTimer = import ./lib/store-refresh-timer.nix { };
in
@ -58,11 +62,12 @@ in
systemd.services.hive-priv-cache-facts = {
description = "Read the swarm cache's public key and pull token for hive-priv";
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
wants = [ "network-online.target" ] ++ storeContainer;
after = [
"network-online.target"
"systemd-tmpfiles-setup.service"
];
]
++ storeContainer;
path = [
baoDeploy.package
pkgs.coreutils

9
nix/host-modules/hive-squid-credential.nix
View file

@ -30,6 +30,10 @@ let
credentialFile = "/run/credstore/${hyperhiveCfg.deploy.hive-controller.squid.selfcheck.credentialName}";
# Where the store runs on this host, its container is up before the first
# login attempt instead of failing against a store that is still starting.
storeContainer = lib.optional baoDeploy.enable "container@${baoCfg.machine}.service";
storeRetry = import ./lib/store-retry.nix { };
storeRefreshTimer = import ./lib/store-refresh-timer.nix { };
in
@ -39,11 +43,12 @@ in
description = "Read the squid self-check's password from the swarm secret store";
wantedBy = [ "multi-user.target" ];
before = [ "squid-selfcheck.service" ];
wants = [ "network-online.target" ];
wants = [ "network-online.target" ] ++ storeContainer;
after = [
"network-online.target"
"systemd-tmpfiles-setup.service"
];
]
++ storeContainer;
path = [
baoDeploy.package
pkgs.coreutils

6
nix/host-modules/swarm-bao.nix
View file

@ -4136,6 +4136,12 @@ in
containers.${cfg.machine} = {
autoStart = true;
ephemeral = false;
# The container is `Type=notify`, so its start job waits for OpenBao,
# whose first start after a restart takes 60-144 s opening the raft
# storage. The 1min default kills it mid-open and every retry is cold.
timeoutStartSec = "5min";
inherit privateNetwork;
# Only material an operator has to be able to back up crosses the

28
nix/module-eval/hive-tls.nix
View file

@ -822,6 +822,34 @@ let
&& !(noIdentity.systemd.services ? squid-selfcheck-credential)
&& !(noIdentity.systemd.timers ? squid-selfcheck-credential);
}
{
# Both units log in to the store, so where its container runs here they
# start after it. Controls: the units exist on `noService`, which reads
# a store it does not run, and carry no container there.
name = "the cache-facts and squid credential units wait for the store's container only where it runs here";
ok =
let
ref = "container@swarm-bao.service";
waits = u: lib.elem ref u.after && lib.elem ref u.wants;
names = [
"hive-priv-cache-facts"
"squid-selfcheck-credential"
];
in
lib.all (n: waits allLocal.systemd.services.${n}) names
&& lib.all (
n:
noService.systemd.services ? ${n}
&& !(lib.elem ref noService.systemd.services.${n}.after)
&& !(lib.elem ref noService.systemd.services.${n}.wants)
) names;
}
{
# The container is `Type=notify`: its start job lasts as long as
# OpenBao's first start, which a 1min limit cuts off mid-open.
name = "the store's container is given five minutes to start";
ok = lib.hasInfix "TimeoutStartSec=5min" allLocal.systemd.units."container@swarm-bao.service".text;
}
{
name = "hive-priv is told the cache's address by the host's configuration";
ok =