vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

retry the authelia mint and the appservice render until the store answers, and let tuwunel retry

Browse source
This commit is contained in:
atlas 2026-11-01 10:47:50 +01:00
commit c4924d227b
1 changed files with 85 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/module-eval/bao-matrix-reader.nix
View file

@ -264,15 +264,23 @@ let
{
# A missing `LoadCredential` source fails tuwunel, so the render has to
# have run first. It fetches from the store, so it carries the store's
# address and matrix-ctl's identity, and retries on failure: a store
# that does not answer keeps the homeserver down until it does.
name = "the swarm registration is rendered before tuwunel and required by it, from the store, with retries";
# address and matrix-ctl's identity, and retries on failure. It is
# `wantedBy` tuwunel, not `requiredBy`: a start whose dependency failed
# never runs, so tuwunel's own retry never began and nothing brought it
# back. tuwunel retries without a start limit, so it starts once a
# render has landed.
name = "the swarm registration is rendered before tuwunel and wanted by it, from the store, and tuwunel retries without a limit";
ok =
let
r = baoWithMatrix.containers.hive-matrix.config.systemd.services.swarm-matrix-appservice-render;
in
lib.elem "tuwunel.service" r.before
&& lib.elem "tuwunel.service" r.requiredBy
&& lib.elem "tuwunel.service" r.wantedBy
&& !(lib.elem "tuwunel.service" (r.requiredBy or [ ]))
&&
baoWithMatrix.containers.hive-matrix.config.systemd.services.tuwunel.serviceConfig.Restart
== "on-failure"
&& baoWithMatrix.containers.hive-matrix.config.systemd.services.tuwunel.startLimitIntervalSec == 0
&& lib.hasSuffix "swarm-matrix-ctl appservice render" r.serviceConfig.ExecStart
&& r.environment.BAO_ADDR != ""
&& r.environment.BAO_CLIENT_CERT == "/var/lib/swarm-bao-pki/matrix-ctl.pem"
@ -284,7 +292,7 @@ let
# down, so it must run when the render has failed: it is after the
# render, and neither requires nor binds to it. It stays off tuwunel's
# own start path, and tuwunel names it nowhere. The presence arms are the
# render's own ordering (the same lookup finds `before`/`requiredBy`
# render's own ordering (the same lookup finds `before`/`wantedBy`
# where they are) and the sync's order after the render.
name = "the sync unit runs after the render without requiring it, and is off tuwunel's start path";
ok =