vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nix: drop the central-toggle conjunct from four compound gates

Browse source 
`services.hyperhive.enable` is going away (Refs #4500). These four blocks
ANDed it with a second condition that was already the load-bearing one:
the bridge-firewall hole asks whether an operator named any
`network.exposeHostPorts`, and the three swarm-level services ask their
own `deploy.*.enable`, each of which defaults false (swarm-ui derives
from the controller's toggle, a sibling deployment decision) and none of
which is derived from the hive toggle. So dropping the conjunct turns
nothing on by itself — the remaining condition still decides.

The way that claim fails is by something becoming unconditional, so
module-eval gets absence arms for all four, each asserted on a host with
the hive ON and on one with it OFF, plus the two controls that make the
absences mean something.

The swarm-controller arm is probed by the credential oneshot and by the
daemon's `ExecStart` rather than by the unit name: hive-tls defines an
environment key on that name, which leaves an inert fragment behind on
any hive with a CA whether or not the controller runs there.
This commit is contained in:
atlas 2026-09-19 03:30:34 +02:00 • committed by mara
commit ce3b3d9467
5 changed files with 105 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/host-modules/hive-network.nix
View file

@ -276,7 +276,7 @@ in
# is firewall-only by design: a host service that binds `0.0.0.0` already
# serves the bridge IP, so an extra bridge-IP proxy would only collide
# (EADDRINUSE) with it. Merges with the [ 80 443 ] gateway ports above.
(lib.mkIf (config.services.hyperhive.enable && cfg.exposeHostPorts != [ ]) {
(lib.mkIf (cfg.exposeHostPorts != [ ]) {
networking.firewall.interfaces.${cfg.bridgeName}.allowedTCPPorts = cfg.exposeHostPorts;
})
];

2
nix/host-modules/swarm-controller.nix
View file

@ -698,7 +698,7 @@ in
};
};
config = lib.mkIf (config.services.hyperhive.enable && deployCfg.swarm-controller.enable) {
config = lib.mkIf deployCfg.swarm-controller.enable {
# The daemon and the oneshot that mints its credential — the second one
# failing leaves the first running and unable to authenticate anywhere.
services.hyperhive.swarm.otel.journaldUnits = [

2
nix/host-modules/swarm-otel.nix
View file

@ -563,7 +563,7 @@ in
};
};
config = lib.mkIf (config.services.hyperhive.enable && deployCfg.swarm-otel.enable) {
config = lib.mkIf deployCfg.swarm-otel.enable {
# The gateway name, inside `deployCfg.swarm-otel.enable` — that guard is the load-bearing
# part. Every hive in a swarm may know this collector exists, but only
# the host that RUNS it may claim the name; a client hive declaring the

2
nix/host-modules/swarm-ui.nix
View file

@ -97,7 +97,7 @@ in
'';
};
config = lib.mkIf (config.services.hyperhive.enable && deployCfg.swarm-ui.enable) {
config = lib.mkIf deployCfg.swarm-ui.enable {
assertions = [
{
# The `_` default server already answers for the hive domain