vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

require both attic options, follow attic's cache-name rule, read the token from a file

Browse source
This commit is contained in:
atlas 2026-10-27 10:46:36 +01:00
commit bd214b9f3e
1 changed files with 156 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/host-modules/swarm-builder.nix
View file

@ -90,8 +90,8 @@ let
hyperhiveFlake = hyperhiveCfg.c0re.hyperhiveFlake;
nixpkgsFlake = hyperhiveCfg.c0re.nixpkgsFlake;
# Either half alone reaches the daemon too, which refuses to start on it.
pushesToCache = atticCfg.domain != null || atticCfg.cache != null;
# The assertion below keeps the two options together.
pushesToCache = atticCfg.domain != null;
privateNetwork = true;
in
@ -133,6 +133,14 @@ in
host's /var/lib/swarm-bao-pki/ and name them in those two options.
'';
}
{
assertion = (atticCfg.domain == null) == (atticCfg.cache == null);
message = ''
services.hyperhive.swarm.attic.domain and services.hyperhive.swarm.attic.cache
must be set together: the swarm builder pushes to a cache on a server, and
either alone names nothing to push to.
'';
}
{
assertion = lib.all oneWord (lib.attrValues storeFiles);
message = ''
@ -257,10 +265,8 @@ in
SWARM_BUILDER_FORGE_URL = "https://${forgeCfg.domain}";
SWARM_BUILDER_CONFIG_ORG = "agent-configs";
}
// lib.optionalAttrs (atticCfg.domain != null) {
// lib.optionalAttrs pushesToCache {
SWARM_BUILDER_ATTIC_DOMAIN = atticCfg.domain;
}
// lib.optionalAttrs (atticCfg.cache != null) {
SWARM_BUILDER_ATTIC_CACHE = atticCfg.cache;
}
// lib.optionalAttrs (storeFiles ? builder-bao-server-ca) {
@ -276,7 +282,7 @@ in
DynamicUser = true;
CacheDirectory = unit;
# /run/swarm-builder, mode 0700 and owned by the dynamic user: the
# push writes its token-bearing `attic` config under it.
# push writes its token file and `attic` config under it.
RuntimeDirectory = unit;
RuntimeDirectoryMode = "0700";
# Bare ids: the system credentials nspawn handed in.