vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

keep the matrix appservice registration in bao, with the host file as the last copy

Browse source
This commit is contained in:
atlas 2026-10-27 13:52:17 +01:00
commit d5c5862654
1 changed files with 1014 additions and 273 deletions
Download patch file Download diff file Expand all files Collapse all files

63
nix/module-eval/bao-matrix-reader.nix
View file

@ -171,7 +171,7 @@ let
ok =
let
env =
baoWithMatrix.containers.hive-matrix.config.systemd.services.swarm-matrix-appservice-publish.environment;
baoWithMatrix.containers.hive-matrix.config.systemd.services.swarm-matrix-appservice-sync.environment;
hiveLeaf = baoWithMatrix.services.hyperhive.deploy.bao.clientCertFile;
in
env.BAO_CLIENT_CERT == "/var/lib/swarm-bao-pki/matrix-ctl.pem" && env.BAO_CLIENT_CERT != hiveLeaf;
@ -193,24 +193,26 @@ let
# agreement the unit cannot get wrong, and the verb: a bare invocation
# exits non-zero with clap's usage, a deploy-time failure with no local
# signal.
name = "the publish unit is handed the store role and invokes its verb";
name = "the sync unit is handed the store role, the sender and the homeserver unit, and invokes its verb";
ok =
let
u = baoWithMatrix.containers.hive-matrix.config.systemd.services.swarm-matrix-appservice-publish;
u = baoWithMatrix.containers.hive-matrix.config.systemd.services.swarm-matrix-appservice-sync;
in
u.environment.MATRIX_APPSERVICE_CERT_ROLE == "swarm-matrix-ctl"
&& lib.hasSuffix "/bin/swarm-matrix-ctl appservice publish" u.serviceConfig.ExecStart;
&& u.environment.MATRIX_APPSERVICE_RESTART_UNIT == "tuwunel.service"
&& u.environment.MATRIX_APPSERVICE_SENDER == "swarm"
&& lib.hasSuffix "/bin/swarm-matrix-ctl appservice sync" u.serviceConfig.ExecStart;
}
{
# 🩸 A secret is a path, never a value. Every variable the unit is given
# names a file or an address; the token itself is read out of the state
# dir at runtime, so nothing here can be a token and an environment block
# is world-readable through `systemctl show`.
name = "the publish unit's environment carries paths and addresses, never a token";
name = "the sync unit's environment carries paths and addresses, never a token";
ok =
let
env =
baoWithMatrix.containers.hive-matrix.config.systemd.services.swarm-matrix-appservice-publish.environment;
baoWithMatrix.containers.hive-matrix.config.systemd.services.swarm-matrix-appservice-sync.environment;
in
!(lib.any (v: lib.hasInfix "as_token" v || lib.hasInfix "syt_" v) (lib.attrValues env));
}
@ -272,6 +274,52 @@ let
&& lib.hasSuffix "swarm-matrix-ctl appservice render" r.serviceConfig.ExecStart
&& !(r.environment ? BAO_ADDR);
}
{
# The start path stays free of the store. The render is what tuwunel
# waits for and it carries no store address or identity; the sync unit
# that does is neither before tuwunel nor required by it, and tuwunel
# names it nowhere, so a store outage leaves the homeserver starting on
# the state dir's last copy. The presence arms are the render's own
# ordering (the same lookup finds `before`/`requiredBy` where they are)
# and the sync's order after the render.
name = "the sync unit is off tuwunel's start path and the render holds no store identity";
ok =
let
c = baoWithMatrix.containers.hive-matrix.config.systemd;
r = c.services.swarm-matrix-appservice-render;
s = c.services.swarm-matrix-appservice-sync;
t = c.services.tuwunel;
names =
u:
lib.concatLists [
(u.after or [ ])
(u.requires or [ ])
(u.wants or [ ])
(u.bindsTo or [ ])
];
sync = "swarm-matrix-appservice-sync.service";
in
lib.elem "tuwunel.service" r.before
&& lib.elem "swarm-matrix-appservice-render.service" s.after
&& !(lib.elem "tuwunel.service" (s.before or [ ]))
&& !(lib.elem "tuwunel.service" (s.requiredBy or [ ]))
&& !(lib.elem "tuwunel.service" (s.wantedBy or [ ]))
&& !(lib.elem sync (names t))
&& !(lib.elem sync (r.before or [ ]))
&& !(lib.any (lib.hasPrefix "BAO_") (lib.attrNames r.environment));
}
{
# A timer repeats the sync, which needs a unit that does not stay
# `active` after a run.
name = "the sync unit is repeated by a timer and does not stay active";
ok =
let
c = baoWithMatrix.containers.hive-matrix.config.systemd;
in
c.timers.swarm-matrix-appservice-sync.timerConfig.OnUnitInactiveSec == "10min"
&& !(c.services.swarm-matrix-appservice-sync.serviceConfig.RemainAfterExit or false)
&& (c.services.swarm-matrix-appservice-render.serviceConfig.RemainAfterExit or false);
}
{
# The absence arm for the four above: with no matrix-ctl identity there
# is nobody to publish the swarm token, so no admin, no registration and
@ -284,7 +332,8 @@ let
in
!(g ? admin_execute)
&& !(c.systemd.services ? swarm-matrix-appservice-render)
&& !(c.systemd.services ? swarm-matrix-appservice-publish)
&& !(c.systemd.services ? swarm-matrix-appservice-sync)
&& !(c.systemd.timers ? swarm-matrix-appservice-sync)
&& !(lib.any (lib.hasPrefix "swarm-appservice.yaml") c.systemd.services.tuwunel.serviceConfig.LoadCredential);
}
];