From b590038b0f0d504f2fffa68d8552df34ce1172e4 Mon Sep 17 00:00:00 2001 From: atlas Date: Thu, 17 Sep 2026 19:27:29 +0200 Subject: [PATCH] module-eval: assert the swarm-controller socket's default, not its deleted shim readOnly means socketPath can only ever hold the default, so the fixture's old custom value can no longer reach the unit and the check.module-eval assertion for it was failing. Assert the default instead of deleting the check -- it still catches the env var vanishing or being misspelled, which deleting it would not. Also corrects the block's stale 'FOUR movers' count: socketPath lost its pre-rename shim in the same slice, so only three of the asserted values are still rename-shim movers. --- nix/module-eval.nix | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/nix/module-eval.nix b/nix/module-eval.nix index 9b4fca63..6ca1a0cb 100644 --- a/nix/module-eval.nix +++ b/nix/module-eval.nix @@ -964,16 +964,22 @@ let # proxying to a path nothing creates. All four old paths are defined in # the fixture, so removing any single shim fails the eval rather than # only the one this assertion reads. - # All FOUR movers are asserted as rendered effects rather than as option - # values, so a rename that resolved but stopped reaching the module is - # caught per-option instead of only where one assertion happens to look. + # THREE movers (authBridgeUrl, forgeTokenFile, queue.clientSecretFile) + # are asserted as rendered effects rather than as option values, so a + # rename that resolved but stopped reaching the module is caught + # per-option instead of only where one assertion happens to look. + # socketPath is no longer one of them: it went readOnly and lost its + # shim in the same slice, so it has no pre-rename path left to prove + # reaches the unit — the SOCKET line below instead pins the one value + # it can ever hold, the default, so the env var vanishing or being + # misspelled still fails this arm. name = "a config written against the pre-rename swarm-controller paths still reaches the unit"; ok = let u = controllerOldPath.systemd.services.swarm-controller; creds = u.serviceConfig.LoadCredential; in - u.environment.SWARM_CONTROLLER_SOCKET == "/run/test-ctrl/ctrl.sock" + u.environment.SWARM_CONTROLLER_SOCKET == "/run/swarm-controller/controller.sock" && u.environment.SWARM_CONTROLLER_AUTH_BRIDGE_URL == "http://127.0.0.1:19097" && lib.any (c: lib.hasInfix "/run/secrets/ctrl-queue.secret" c) creds && lib.any (c: lib.hasInfix "/run/secrets/ctrl-forge.token" c) creds;