vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

grafana: make socketDir readOnly and drop its rename alias

Browse source 
The socket's directory is its access control, so it has to stay dedicated
to Grafana's one socket. Nothing in the tree sets the option; making it
read-only turns "point it at a shared directory" into an eval error
instead of a convention.

A rename shim contributes a definition to its target, which a read-only
option refuses, so the swarm.grafana.socketDir alias goes with it. The
module-eval fixture no longer sets the old path; a new case asserts that
defining the option fails evaluation and that the default reaches nginx.
This commit is contained in:
atlas 2026-10-11 23:33:20 +02:00 • committed by mara
commit e2ea842a93
3 changed files with 37 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/host-modules/swarm-grafana.nix
View file

@ -291,10 +291,15 @@ in
socketDir = lib.mkOption {
type = lib.types.str;
default = "/run/swarm-grafana";
readOnly = true;
description = ''
Directory holding the unix socket Grafana serves on, shared between
the host (where nginx runs) and the container (where Grafana runs).
Fixed, not configurable: the directory's mode is what keeps the socket
private, so it has to be dedicated to this one socket, and a settable
path could be pointed at a directory that carries something else.
⚠️ **Grafana takes no TCP port at all, and that is the point.** Every
swarm service container shares the host's network namespace, so a
port is a swarm-wide resource that two modules can silently both