vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

move the squid host options to deploy.hive-controller.squid

Browse source
This commit is contained in:
atlas 2026-10-29 01:26:02 +01:00 • committed by mara
commit da16487800
3 changed files with 168 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nix/module-eval/bao-controller.nix
View file

@ -256,7 +256,7 @@ let
name = "the controller is handed the base list squid defaults to";
ok =
let
base = baoControllerHere.services.hyperhive.squid.baseAllowedDomains;
base = baoControllerHere.services.hyperhive.deploy.hive-controller.squid.baseAllowedDomains;
in
base != [ ]
&&

67
nix/module-eval/core-toggle.nix
View file

@ -1621,6 +1621,73 @@ let
&& (locs h.swarm.forge.domain)."/".proxyPass == "http://127.0.0.1:3000/"
&& !allLocal.containers.hive-matrix.config.services.matrix-tuwunel.settings.global.allow_encryption;
}
{
# Each old spelling lands on the new path, with its own rename warning;
# the squid.conf it renders equals the one the new spelling renders, and
# differs from the default's (the control that the values reach it).
name = "services.hyperhive.squid.* settings still apply, with a rename warning each";
ok =
let
old = hiveWithController {
squid = {
allowedDomains = [ "legacy.example" ];
baseAllowedDomains = [ "base.example" ];
usersFile = "/var/lib/legacy-squid/users";
selfcheck.unrestrictedCanary = "legacy-u.example";
selfcheck.canary = "legacy-c.example";
};
};
new = hiveWithController {
deploy.hive-controller.squid = {
allowedDomains = [ "legacy.example" ];
baseAllowedDomains = [ "base.example" ];
usersFile = "/var/lib/legacy-squid/users";
selfcheck.unrestrictedCanary = "legacy-u.example";
selfcheck.canary = "legacy-c.example";
};
};
sq = old.services.hyperhive.deploy.hive-controller.squid;
warned =
m: path:
lib.any (
w: lib.hasInfix "services.hyperhive.squid.${path}" w && lib.hasInfix "has been renamed" w
) m.warnings;
in
sq.allowedDomains == [ "legacy.example" ]
&& sq.baseAllowedDomains == [ "base.example" ]
&& sq.usersFile == "/var/lib/legacy-squid/users"
&& sq.allowedFile == "/var/lib/legacy-squid/allowed"
&& sq.selfcheck.unrestrictedCanary == "legacy-u.example"
&& sq.selfcheck.canary == "legacy-c.example"
&& lib.all (warned old) [
"allowedDomains"
"baseAllowedDomains"
"usersFile"
"selfcheck.unrestrictedCanary"
"selfcheck.canary"
]
&& !(warned bare "allowedDomains")
&& old.systemd.services.hive-c0re.environment.HIVE_SQUID_USERS_FILE == "/var/lib/legacy-squid/users"
&& old.services.squid.configText == new.services.squid.configText
&& lib.hasInfix "legacy-c.example" old.services.squid.configText
&& !(lib.hasInfix "legacy-c.example" bare.services.squid.configText);
}
{
# The default render, pinned so moving the options changes none of it:
# the listen address squid binds and hive-c0re hands out, and the users
# file hive-c0re writes.
name = "squid's default listen address and users file reach squid.conf and hive-c0re unchanged";
ok =
let
e = bare.systemd.services.hive-c0re.environment;
conf = bare.services.squid.configText;
in
e.HIVE_SQUID_PROXY == "${bare.services.hyperhive.network.bridgeIp}:3128"
&& e.HIVE_SQUID_USERS_FILE == "/var/lib/hive-squid/users"
&& lib.hasInfix "http_port ${e.HIVE_SQUID_PROXY}" conf
&& lib.hasInfix "basic_ncsa_auth /var/lib/hive-squid/users" conf
&& lib.hasInfix "acl allowed_dst dstdomain cache.nixos.org" conf;
}
{
# A hive's rendered identity, pinned so moving the option changes none of
# it: the coordinator's name and client, the dashboard name, the CN of the

23
nix/module-eval/hive-otel.nix
View file

@ -507,7 +507,7 @@ let
unrestricted = at "http_access allow unrestricted";
authed = at "http_access deny !authed";
# The generated per-agent `http_access allow` rules sit in this file.
agentRules = at "include ${hiveOtel.services.hyperhive.squid.agentAllowFile}";
agentRules = at "include ${hiveOtel.services.hyperhive.deploy.hive-controller.squid.agentAllowFile}";
firstAllow = lib.min agentRules (lib.min base (lib.min unrestricted allow));
in
allow != null
@ -550,9 +550,10 @@ let
acl = lib.findFirst (l: lib.hasPrefix "acl allowed_dst dstdomain " l) "" (map lib.trim lines);
baseAcl = lib.findFirst (l: lib.hasPrefix "acl base_dst dstdomain " l) "" (map lib.trim lines);
in
acl == "acl allowed_dst dstdomain ${hiveOtel.services.hyperhive.squid.selfcheck.canary}"
acl
== "acl allowed_dst dstdomain ${hiveOtel.services.hyperhive.deploy.hive-controller.squid.selfcheck.canary}"
&& baseAcl == "acl base_dst dstdomain api.anthropic.com claude.ai platform.claude.com"
&& hiveOtel.services.hyperhive.squid.selfcheck.canary == "cache.nixos.org"
&& hiveOtel.services.hyperhive.deploy.hive-controller.squid.selfcheck.canary == "cache.nixos.org"
&& !(builtins.elem hiveOtel.services.hyperhive.swarm.forge.domain (lib.splitString " " acl));
}
{
@ -592,7 +593,7 @@ let
conf = hiveOtel.services.squid.configText;
lines = lib.splitString "\n" conf;
at = l: lib.lists.findFirstIndex (x: x == l) null lines;
list = hiveOtel.services.hyperhive.squid.unrestrictedFile;
list = hiveOtel.services.hyperhive.deploy.hive-controller.squid.unrestrictedFile;
in
at "http_access allow unrestricted" != null
&& at "http_access deny !allowed_dst" != null
@ -609,15 +610,15 @@ let
name = "squid is reloaded when its unrestricted-users list changes";
ok =
let
list = hiveOtel.services.hyperhive.squid.unrestrictedFile;
list = hiveOtel.services.hyperhive.deploy.hive-controller.squid.unrestrictedFile;
rules = hiveOtel.systemd.tmpfiles.rules;
path = hiveOtel.systemd.paths.squid-unrestricted-reload;
svc = hiveOtel.systemd.services.squid-unrestricted-reload.serviceConfig;
in
path.pathConfig.PathChanged == [
list
hiveOtel.services.hyperhive.squid.allowedFile
hiveOtel.services.hyperhive.squid.agentAllowFile
hiveOtel.services.hyperhive.deploy.hive-controller.squid.allowedFile
hiveOtel.services.hyperhive.deploy.hive-controller.squid.agentAllowFile
]
&& hiveOtel.systemd.services.squid-unrestricted-reload.startLimitIntervalSec == 0
&& builtins.elem "paths.target" path.wantedBy
@ -635,7 +636,7 @@ let
name = "squid reads the swarm's allow-list from a file seeded with the hive's own names";
ok =
let
sq = hiveOtelAllLocal.services.hyperhive.squid;
sq = hiveOtelAllLocal.services.hyperhive.deploy.hive-controller.squid;
lines = lib.splitString "\n" hiveOtelAllLocal.services.squid.configText;
rules = hiveOtelAllLocal.systemd.tmpfiles.rules;
env = hiveOtelAllLocal.systemd.services.hive-c0re.environment;
@ -675,7 +676,7 @@ let
let
conf = hiveOtel.services.squid.configText;
lines = lib.splitString "\n" conf;
users = hiveOtel.services.hyperhive.squid.usersFile;
users = hiveOtel.services.hyperhive.deploy.hive-controller.squid.usersFile;
rules = hiveOtel.systemd.tmpfiles.rules;
sc = hiveOtel.systemd.services.squid-selfcheck.serviceConfig;
in
@ -686,7 +687,9 @@ let
&& users == "/var/lib/hive-squid/users"
&& builtins.elem "d /var/lib/hive-squid 2750 hive-core squid - -" rules
&& builtins.elem "f ${users} 0640 hive-core squid - -" rules
&& sc.ImportCredential == hiveOtel.services.hyperhive.squid.selfcheck.credentialName
&&
sc.ImportCredential
== hiveOtel.services.hyperhive.deploy.hive-controller.squid.selfcheck.credentialName
&& hiveOtelAllLocal.systemd.services.hive-c0re.environment.HIVE_SQUID_USERS_FILE == users;
}
{