From b94382b81525c4f98a4f63739674d20274e229cb Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 5 Aug 2026 17:50:46 +0200 Subject: [PATCH] feat(nix): one switch for an all-on-one-host deployment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `services.hyperhive.enableAllLocalDefaults` is the single "everything runs on this box" toggle, and the autoconfigurable settings default from it: `swarm.enableRequiredServices` (new — the swarm's shared services run here) and `swarm.ca.autoConfigure` (previously an explicit false). Off by default, unchanged from before: a host cannot tell whether it is the one meant to hold the swarm's services or its CA, so this stays an operator saying "this is that box". What it replaces is one toggle per service for the deployment where the answer is "all of them". Each derived toggle can still be set on its own, so "all local except X" needs no further option. --- nix/host-modules/hyperhive.nix | 26 ++++++++++++++++++++++++++ nix/host-modules/swarm-ca.nix | 9 ++++++++- nix/host-modules/swarm.nix | 25 +++++++++++++++++++++++++ 3 files changed, 59 insertions(+), 1 deletion(-) diff --git a/nix/host-modules/hyperhive.nix b/nix/host-modules/hyperhive.nix index 6de59aee..d370aeab 100644 --- a/nix/host-modules/hyperhive.nix +++ b/nix/host-modules/hyperhive.nix @@ -132,6 +132,32 @@ in ''; }; + # The one switch for "everything runs on this box". Every autoconf + # toggle in the tree defaults from it, so an all-local deployment is a + # single line rather than one line per service that grew a toggle. + options.services.hyperhive.enableAllLocalDefaults = lib.mkOption { + type = lib.types.bool; + default = false; + example = true; + description = '' + Run the whole swarm on this host: the swarm-wide services + (`services.hyperhive.swarm.enableRequiredServices`) and the swarm + CA (`services.hyperhive.swarm.ca.autoConfigure`) all default from + this, and anything autoconfigurable added later should too. + + **Off by default, and that is the load-bearing part.** A swarm's + services and its hives can live on different hosts, and a host has + no way to tell which ones it is meant to be — so this is an + operator saying "this is that box", never something inferred. + Turn it on for a dev box or a single-hive swarm and get a working + deployment with no further configuration; leave it off and every + swarm-level artifact is operator-provided. + + Each derived toggle can still be set explicitly to override this + one, so "all local except X" needs no new option. + ''; + }; + # Whether this hive runs "ruthless" — with no root/manager agent at # all. Some hives don't want a root agent — see issue tracker # "scope concept: special agents". diff --git a/nix/host-modules/swarm-ca.nix b/nix/host-modules/swarm-ca.nix index 75607c24..5e7ed467 100644 --- a/nix/host-modules/swarm-ca.nix +++ b/nix/host-modules/swarm-ca.nix @@ -52,12 +52,19 @@ in options.services.hyperhive.swarm.ca = { autoConfigure = lib.mkOption { type = lib.types.bool; - default = false; + default = hyperhiveCfg.enableAllLocalDefaults; + defaultText = lib.literalExpression "services.hyperhive.enableAllLocalDefaults"; example = true; description = '' Run the whole swarm CA on this one host: generate the swarm root when it is missing, and issue this hive's CA under it. + Defaults from `services.hyperhive.enableAllLocalDefaults`, the + all-on-one-box switch — which is off, so this is off, and the + paragraph below still describes what a hive does by default. + Set it directly to run the CA on a host that is not otherwise + all-local. + **Off by default, deliberately.** A swarm's services and its hives can live on different hosts, and this host has no way to tell whether it is the one holding the root — so the swarm CA diff --git a/nix/host-modules/swarm.nix b/nix/host-modules/swarm.nix index 4430432a..f7be1a33 100644 --- a/nix/host-modules/swarm.nix +++ b/nix/host-modules/swarm.nix @@ -126,6 +126,31 @@ ''; }; + # "The swarm-wide services run HERE." A swarm has one forge, one + # matrix, one SSO — this says this host is where they live, and each + # of those services defaults its own enable from it rather than the + # operator enabling them one at a time. + options.services.hyperhive.swarm.enableRequiredServices = lib.mkOption { + type = lib.types.bool; + default = config.services.hyperhive.enableAllLocalDefaults; + defaultText = lib.literalExpression "services.hyperhive.enableAllLocalDefaults"; + example = true; + description = '' + Host the swarm's shared services on this hive. The services that + exist once per swarm rather than once per hive — the forge, the + matrix homeserver, the SSO provider — default their `enable` from + this, so a swarm's service host is declared in one place. + + Defaults from `services.hyperhive.enableAllLocalDefaults` (off), + which is the all-on-one-box switch. Set it directly to run the + swarm's services on a host that is not otherwise all-local — a + dedicated services box with hives elsewhere is exactly that shape. + + With it off, this hive is a *client* of those services: it still + configures how to reach them, it just doesn't run them. + ''; + }; + options.services.hyperhive.swarm.snapshotStore = { address = lib.mkOption { type = lib.types.nullOr lib.types.str;