vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

retry the authelia mint and the appservice render until the store answers, and let tuwunel retry

Browse source
This commit is contained in:
atlas 2026-11-01 10:47:50 +01:00
commit c4924d227b
2 changed files with 85 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/module-eval/bao-matrix-reader.nix
View file

@ -264,15 +264,23 @@ let
{
# A missing `LoadCredential` source fails tuwunel, so the render has to
# have run first. It fetches from the store, so it carries the store's
# address and matrix-ctl's identity, and retries on failure: a store
# that does not answer keeps the homeserver down until it does.
name = "the swarm registration is rendered before tuwunel and required by it, from the store, with retries";
# address and matrix-ctl's identity, and retries on failure. It is
# `wantedBy` tuwunel, not `requiredBy`: a start whose dependency failed
# never runs, so tuwunel's own retry never began and nothing brought it
# back. tuwunel retries without a start limit, so it starts once a
# render has landed.
name = "the swarm registration is rendered before tuwunel and wanted by it, from the store, and tuwunel retries without a limit";
ok =
let
r = baoWithMatrix.containers.hive-matrix.config.systemd.services.swarm-matrix-appservice-render;
in
lib.elem "tuwunel.service" r.before
&& lib.elem "tuwunel.service" r.requiredBy
&& lib.elem "tuwunel.service" r.wantedBy
&& !(lib.elem "tuwunel.service" (r.requiredBy or [ ]))
&&
baoWithMatrix.containers.hive-matrix.config.systemd.services.tuwunel.serviceConfig.Restart
== "on-failure"
&& baoWithMatrix.containers.hive-matrix.config.systemd.services.tuwunel.startLimitIntervalSec == 0
&& lib.hasSuffix "swarm-matrix-ctl appservice render" r.serviceConfig.ExecStart
&& r.environment.BAO_ADDR != ""
&& r.environment.BAO_CLIENT_CERT == "/var/lib/swarm-bao-pki/matrix-ctl.pem"
@ -284,7 +292,7 @@ let
# down, so it must run when the render has failed: it is after the
# render, and neither requires nor binds to it. It stays off tuwunel's
# own start path, and tuwunel names it nowhere. The presence arms are the
# render's own ordering (the same lookup finds `before`/`requiredBy`
# render's own ordering (the same lookup finds `before`/`wantedBy`
# where they are) and the sync's order after the render.
name = "the sync unit runs after the render without requiring it, and is off tuwunel's start path";
ok =

23
nix/module-eval/secret-publisher.nix
View file

@ -424,6 +424,29 @@ let
)
&& lib.any (lib.hasPrefix "--load-credential=") secretPublisherHere.containers.swarm-authelia.extraFlags;
}
{
# A mint that cannot read the store fails after rendering from the
# digests, and retries without a limit; authelia `wants` it, so a failed
# run does not stop authelia starting from them. The control is the
# no-identity shape, where the generator still gates authelia.
name = "a mint that cannot read the store retries without a limit and does not hold authelia back";
ok =
let
here = inAuthelia secretPublisherHere;
u = here.systemd.services.authelia-swarm-secrets;
files = (inAuthelia secretPublisherNoIdentity).systemd.services.authelia-swarm-secrets;
in
lib.elem "authelia-swarm.service" u.wantedBy
&& !(lib.elem "authelia-swarm.service" (u.requiredBy or [ ]))
&& lib.elem "authelia-swarm.service" u.before
&& u.serviceConfig.Restart == "on-failure"
&& u.serviceConfig.RestartSec == 15
&& u.startLimitIntervalSec == 0
&& lib.hasInfix "STORE_UNREADABLE=1" u.script
&& lib.hasInfix "chmod 0600 \"$users\"\nif [ -n \"\${STORE_UNREADABLE-}\" ]; then" u.script
&& lib.elem "authelia-swarm.service" files.requiredBy
&& !(lib.hasInfix "STORE_UNREADABLE" files.script);
}
{
# With a store identity no unit writes a plaintext client secret under
# /var/lib: the mint keeps no `$sec` file, no redirect in the container