vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

grafana: make socketDir readOnly and drop its rename alias

Browse source 
The socket's directory is its access control, so it has to stay dedicated
to Grafana's one socket. Nothing in the tree sets the option; making it
read-only turns "point it at a shared directory" into an eval error
instead of a convention.

A rename shim contributes a definition to its target, which a read-only
option refuses, so the swarm.grafana.socketDir alias goes with it. The
module-eval fixture no longer sets the old path; a new case asserts that
defining the option fails evaluation and that the default reaches nginx.
This commit is contained in:
atlas 2026-10-11 23:33:20 +02:00 • committed by mara
commit e2ea842a93
3 changed files with 37 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

21
nix/module-eval/grafana.nix
View file

@ -23,13 +23,20 @@ let
grafanaOldPath = hive {
deploy.grafana.enable = true;
swarm.grafana.socketDir = "/run/test-grafana-sock";
swarm.grafana.datasourceUrl = "http://127.0.0.1:19999";
swarm.grafana.logsDatasourceUrl = "http://127.0.0.1:19998";
swarm.grafana.plugins = [ ];
swarm.grafana.package = pkgs.emptyDirectory;
};
# A host that tries to move the socket directory; reading the option throws.
grafanaSocketDirSet = hive {
deploy.grafana.enable = true;
deploy.grafana.socketDir = "/run/test-grafana-sock";
deploy.grafana.plugins = [ ];
deploy.grafana.package = pkgs.emptyDirectory;
};
# Same pairing `nix/module-eval/bao-otel-collector.nix` uses for its own
# cases: the store's container with its own collector on, so
# `.containers.swarm-bao.config` carries a real, evaluated
@ -101,6 +108,18 @@ let
&& lib.hasInfix option a.message
) m.assertions;
cases = [
{
# The socket's directory is its access control, so it must stay dedicated
# to this one socket. `readOnly` is what makes that inexpressible: a
# definition anywhere — here at the `deploy` path — has to fail the eval,
# and an unset host has to render the default into nginx's upstream.
name = "grafana's socket directory cannot be set and renders its default";
ok =
!(builtins.tryEval grafanaSocketDirSet.services.hyperhive.deploy.grafana.socketDir).success
&&
grafanaOldPath.services.nginx.virtualHosts."grafana-metrics".locations."= /metrics".proxyPass
== "http://unix:/run/swarm-grafana/grafana.sock:/metrics";
}
{
# This fixture enables grafana and NOT authelia, so the login-form toggle
# has to follow "grafana requires SSO" rather than "both services are on