From e990e9a0be14be211bc0b51e5d1487e086f1127a Mon Sep 17 00:00:00 2001 From: atlas Date: Mon, 5 Oct 2026 03:13:02 +0200 Subject: [PATCH] nix: finish the current-behaviour comment sweep in touched files Rewrite the remaining narration in files the previous commit touched: "moved"/"sat"/"was REMOVED"/"old default" comments in swarm-bao, swarm-otel, glue-bao-tls, nats-authelia, swarm-controller, swarm-ui, swarm-otel-service, swarm-authelia-service, the deploy.nix rename table, hive-ci, hive-forge/service, hive-tls, hyperhive, swarm-nats, swarm.nix and a few module-eval fixtures, so each says where a thing is or why it is so now. Revert the comment edits inside shell script strings in hive-tls, swarm-nats and the forge token mint to their previous text, so those generated units are unchanged. The only unit still changing is swarm-bao-pki (two comment lines in its script). Refs #3902 --- nix/agent-modules/renamed-options.nix | 4 +- nix/host-modules/deploy.nix | 41 ++++++++++----------- nix/host-modules/glue-bao-tls.nix | 2 +- nix/host-modules/hive-ci.nix | 4 +- nix/host-modules/hive-forge/default.nix | 40 +++++++++++--------- nix/host-modules/hive-forge/service.nix | 6 +-- nix/host-modules/hive-gateway/vhosts.nix | 2 +- nix/host-modules/hive-tls.nix | 21 +++++------ nix/host-modules/hyperhive.nix | 13 +++---- nix/host-modules/swarm-authelia-service.nix | 2 +- nix/host-modules/swarm-bao.nix | 5 +-- nix/host-modules/swarm-controller.nix | 15 ++++---- nix/host-modules/swarm-grafana.nix | 2 +- nix/host-modules/swarm-nats.nix | 5 +-- nix/host-modules/swarm-otel-service.nix | 2 +- nix/host-modules/swarm-otel.nix | 12 +++--- nix/host-modules/swarm-ui.nix | 8 ++-- nix/host-modules/swarm.nix | 2 +- nix/module-eval/bao-otel-collector.nix | 2 +- nix/module-eval/name-guards.nix | 2 +- nix/module-eval/nats-authelia.nix | 15 ++++---- 21 files changed, 102 insertions(+), 103 deletions(-) diff --git a/nix/agent-modules/renamed-options.nix b/nix/agent-modules/renamed-options.nix index 4c51748a..8c10140a 100644 --- a/nix/agent-modules/renamed-options.nix +++ b/nix/agent-modules/renamed-options.nix @@ -93,11 +93,11 @@ [ "hyperhive" "frontend" "extraFiles" ] [ "services" "hyperhive" "agent" "frontend" "extraFiles" ] ) - # `frontend.mergedDist` moved with the rest and deliberately has NO entry: + # `frontend.mergedDist` deliberately has NO entry: # it is `readOnly` and ./frontend.nix already defines it, and a rename # module contributes a *definition* to its target — so a shim for it makes # every evaluation fail with "set multiple times". Nothing could have set - # it anyway; a reader of the old path now gets "option does not exist", + # it anyway; a reader of the old path gets "option does not exist", # which says the same thing sooner. Same reasoning as the `hostUsersFile` # exclusion in ../host-modules/deploy.nix. (lib.mkRenamedOptionModule diff --git a/nix/host-modules/deploy.nix b/nix/host-modules/deploy.nix index 152c31b9..f2ba81a1 100644 --- a/nix/host-modules/deploy.nix +++ b/nix/host-modules/deploy.nix @@ -25,7 +25,7 @@ # exactly that shape, and a bare bool leaves it unrepresentable. # # ⚠️ The renames below are deliberately in this one file rather than -# spread across the service modules, so the whole move has a single home +# spread across the service modules, so all of them have a single home # and a single file to delete when the deprecation window closes — the # shape ./swarm-peers-removed.nix already uses. { lib, config, ... }: @@ -99,8 +99,8 @@ in [ "services" "hyperhive" "swarm" "authelia" "usersFile" ] [ "services" "hyperhive" "deploy" "authelia" "usersFile" ] ) - # `hostClientSecretDir` and `hostUsersFile` moved in the same commit and - # deliberately have NO entry here. A rename module contributes a + # `hostClientSecretDir` and `hostUsersFile` deliberately have NO entry + # here. A rename module contributes a # *definition* to its target, and both are `readOnly`, which refuses a # second one — so a shim for either makes every evaluation fail with # "set multiple times", naming the option's own default as the rival @@ -139,7 +139,7 @@ in [ "services" "hyperhive" "deploy" "swarm-otel" "enable" ] ) # ⚠️ Not to be confused with `services.hyperhive.otel.clientSecretFile`, - # a different option on the hive tier that is not part of this move. A + # a different option on the hive tier that is not part of this table. A # bare `clientSecretFile` matches five distinct options across the tree. (lib.mkRenamedOptionModule [ "services" "hyperhive" "swarm" "otel" "clientSecretFile" ] @@ -177,14 +177,14 @@ in # The queue's callout identity. What stays under `swarm.nats` is what the # queue IS to every hive — the ports it answers on and the client id it is # registered under; these five are what the host running it decides. The - # responder package is one of them now, further down with the other - # `*.package` moves. + # responder package is one of them, renamed further down with the other + # `*.package` entries. # - # ⚠️ The two PUBLIC keys move with their seeds. A public key looks + # ⚠️ The two PUBLIC keys follow their seeds. A public key looks # swarm-wide, and the user key genuinely is published to every client that # connects — but peers RECEIVE it over the wire, they never configure it, # and splitting a keypair across two namespaces is worse than either - # placement. `enable` moved earlier; its shim is the one above. + # placement. `enable`'s shim is the one above. (lib.mkRenamedOptionModule [ "services" "hyperhive" "swarm" "nats" "autoGenerateCallout" ] [ "services" "hyperhive" "deploy" "nats" "autoGenerateCallout" ] @@ -209,8 +209,8 @@ in # The rest of the forge split. What stays under `swarm.forge` is what the # forge IS from any hive's point of view — the names and ports it answers # on, the URLs it advertises, the client id it is registered under; these - # four are what the host running it decides. Its package moved as well, - # further down with the other `*.package` moves. `sso` splits + # four are what the host running it decides. Its package is renamed + # further down with the other `*.package` entries. `sso` splits # because its two halves are different facts: the client id must match the # entry in authelia's register, the secret is a path on this machine. # @@ -238,8 +238,8 @@ in # The homeserver, split the same way. `swarm.matrix` keeps what it IS to # every hive — the name it answers to, the ports and URLs it is reached # on, the client id it is registered under. These six are what the host - # running it decides; its two packages moved as well, further down with - # the other `*.package` moves. ⚠️ `enable` is NOT here: its shim lives in + # running it decides; its two packages are renamed further down with + # the other `*.package` entries. ⚠️ `enable` is NOT here: its shim lives in # ./hive-matrix.nix, so that file is the one # to check before assuming this table is the whole matrix story. (lib.mkRenamedOptionModule @@ -360,11 +360,11 @@ in '' ) - # The WireGuard mesh, whole. Unlike every rename above this one moves a + # The WireGuard mesh, whole. Unlike every rename above this one covers a # namespace rather than a toggle: nothing under it is a fact another hive # reads. A peer needs this host's `wireguardEndpoint` — the roster entry # in ./swarm.nix, which stays — and nothing about the interface this host - # brings up. `listenPort` moves for the same reason and is easy to read + # brings up. `listenPort` follows for the same reason and is easy to read # the other way: it is what this host *binds*, while the port a peer # *dials* is the one inside `wireguardEndpoint`. (lib.mkRenamedOptionModule @@ -389,10 +389,9 @@ in ) # Which build a service runs is a decision of the host that runs it, so - # every `*.package` follows its `enable` across. The split these replace - # was the sharpest case: `gui.enable` had already moved while - # `gui.package` stayed, so one client's two halves sat in two namespaces - # and ./hive-matrix.nix said so in a comment above the option. + # every `*.package` follows its `enable` across. Left in separate + # namespaces they split one client's two halves, as `gui.enable` and + # `gui.package` would. (lib.mkRenamedOptionModule [ "services" "hyperhive" "swarm" "matrix" "package" ] [ "services" "hyperhive" "deploy" "matrix" "package" ] @@ -413,9 +412,9 @@ in [ "services" "hyperhive" "swarm" "victoriametrics" "package" ] [ "services" "hyperhive" "deploy" "victoriametrics" "package" ] ) - # With this one `services.hyperhive.swarm.ui` holds nothing at all — it had - # exactly two options and both have moved, so the namespace now exists only - # as this entry and the `enable` one above it. + # With this one `services.hyperhive.swarm.ui` holds nothing at all — its + # two options are both renamed, so the namespace exists only as this + # entry and the `enable` one above it. (lib.mkRenamedOptionModule [ "services" "hyperhive" "swarm" "ui" "package" ] [ "services" "hyperhive" "deploy" "swarm-ui" "package" ] diff --git a/nix/host-modules/glue-bao-tls.nix b/nix/host-modules/glue-bao-tls.nix index e4b41a74..835d376c 100644 --- a/nix/host-modules/glue-bao-tls.nix +++ b/nix/host-modules/glue-bao-tls.nix @@ -228,7 +228,7 @@ in # is what OPENS the mint, so it cannot come out of it. A certificate # authority that issues the credential admitting you to it is the # cycle this file's header exists to keep out — which is exactly why - # the swarm-services root moved into the store and this one did not. + # the swarm-services root lives in the store and this one does not. # # Its own CN, not the reader's: the hive's own leaf reads every secret # its policy names, while this principal may do one thing — `update` diff --git a/nix/host-modules/hive-ci.nix b/nix/host-modules/hive-ci.nix index a4d66cf4..f2424ae9 100644 --- a/nix/host-modules/hive-ci.nix +++ b/nix/host-modules/hive-ci.nix @@ -197,8 +197,8 @@ in ]; # Tell hive-c0re that CI is enabled so its startup sweep registers the - # runner. Registration moved OFF the container's boot-critical path into - # hive-c0re (`forge/ci_runner.rs`): it validates the persisted `.runner` + # runner. Registration is OFF the container's boot-critical path: + # hive-c0re (`forge/ci_runner.rs`) validates the persisted `.runner` # against the forge and, when absent/stale, mints a registration token and # hands it to hive-priv to write `/run/hive-ci/runner-token` + restart the # runner. The forge admin token stays in hive-c0re; only the registration diff --git a/nix/host-modules/hive-forge/default.nix b/nix/host-modules/hive-forge/default.nix index 1c0bbbe7..b4ee8458 100644 --- a/nix/host-modules/hive-forge/default.nix +++ b/nix/host-modules/hive-forge/default.nix @@ -925,25 +925,29 @@ in # re-mint instead of being silently masked by a stamp that # outlived what it claims exists. if [ ! -s "$token_path" ]; then - # `write:admin` is required by `swarm-controller::forge::Client:: - # ensure_agent_user` (the `CreateForgeUser` jobq node): - # Forgejo's `admin_create_user` HTTP endpoint refuses a - # token without it ("token does not have at least one of - # required scope(s): [write:admin]"). A host whose token was - # minted without this scope keeps it — the - # `[ ! -s "$token_path" ]` guard above only mints when the - # file is absent, by design (see its own comment) — so such a - # deployment needs its token file deleted to force a re-mint - # with the full scope. + # `write:admin` added for `swarm-controller::forge::Client:: + # ensure_agent_user` (the `CreateForgeUser` jobq node) — + # Forgejo's `admin_create_user` HTTP endpoint refused every + # call with "token does not have at least one of required + # scope(s): [write:admin]" without it, an already-deployed + # swarm hitting this the moment that node shipped. A host + # whose token was minted before this scope was added won't + # pick it up automatically — the `[ ! -s "$token_path" ]` + # guard above only mints when the file is absent, by design + # (see its own comment) — so an existing deployment needs + # its token file deleted to force a re-mint with the new + # scope. # - # Token name carries a timestamp suffix rather than a fixed - # name: deleting the token *file* (the remediation above) - # doesn't delete the token Forgejo already has under that - # name, so re-running this unit would fail with "Command - # error: access token name has been used already". Same - # approach `hive-c0re::forge::users::mint_token` uses for its - # own agent tokens — a monotonic suffix means a re-mint can - # never collide with whatever this account already has. + # Token name carries a timestamp suffix rather than the + # fixed `swarm-controller-boot` this used to be — a real + # incident, not a hypothetical: deleting the token *file* + # (the remediation above) doesn't delete the token Forgejo + # already has under that name, so re-running this unit hit + # "Command error: access token name has been used already" + # and failed outright. Same fix `hive-c0re::forge::users:: + # mint_token` already uses for its own agent tokens, for + # the identical reason — a monotonic suffix means a re-mint + # can never collide with whatever this account already has. out=$(forgejo admin user generate-access-token \ --username ${lib.escapeShellArg swarmControllerForgeUser} \ --token-name "swarm-controller-boot-$(date +%s)" \ diff --git a/nix/host-modules/hive-forge/service.nix b/nix/host-modules/hive-forge/service.nix index 716040ca..f5c650b4 100644 --- a/nix/host-modules/hive-forge/service.nix +++ b/nix/host-modules/hive-forge/service.nix @@ -98,10 +98,8 @@ in swarm's domain, not this hive's, because a swarm runs **one** forge that every hive in it talks to. - ⚠️ A deployment that was running before this moved keeps its - current name by pinning it here: - `forge.''${services.hyperhive.domain}`, which is exactly what - the old default rendered. Certificates follow either way: the + ⚠️ To use the per-hive name `forge.''${services.hyperhive.domain}` + instead, pin it here. Certificates follow either way: the swarm-services sub-CA is name-constrained to the configured names (see `./swarm-ca.nix`), not to a fixed tree. diff --git a/nix/host-modules/hive-gateway/vhosts.nix b/nix/host-modules/hive-gateway/vhosts.nix index 1848dfd5..9d7fd640 100644 --- a/nix/host-modules/hive-gateway/vhosts.nix +++ b/nix/host-modules/hive-gateway/vhosts.nix @@ -44,7 +44,7 @@ let publicPortSuffix = if publicPort == 443 then "" else ":${toString publicPort}"; # `/matrix/*` → 301 → `gatewayHost`'s vhost/$1 (`chat.` - # by default; legacy deep-link shim during the fluffychat sub-domain move). + # by default; legacy deep-link shim for the fluffychat sub-domain). # See `docs/networking/gateway.md`. matrixRedirectLocations = lib.optionalAttrs (matrixDeployCfg.enable && matrixCfg.gatewayHost != null) diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix index 77b6246f..49ee6d65 100644 --- a/nix/host-modules/hive-tls.nix +++ b/nix/host-modules/hive-tls.nix @@ -130,9 +130,9 @@ let # leaf to hold, and its absence there is the correct state rather # than a stale one — its own vhosts are covered by the hive leaf # above. Anywhere else it is expected: the leaf comes from the - # secret store's `pki` mount, reachable from every host rather than - # from a sub-CA on one host in the swarm, so "this host cannot issue - # it" is not one of the answers. + # secret store's `pki` mount now, not from a sub-CA that exists on + # one host in the swarm, so "this host cannot issue it" is no longer + # one of the answers. want_svc=${if localServiceDomains == [ ] then "0" else "1"} # Expiry is not the only way a leaf goes wrong. One signed when the @@ -976,15 +976,14 @@ in # they mint a token from authelia over TLS. Declared HERE, beside the # bundle, rather than in each consumer's module: the path is this # module's fact, and two consumers re-deriving `${stateDir}/…` would be - # two places to fix the day it moves. + # two places to fix when it changes. # - # ⚠️ This is what was missing. `swarm-queue-client` built a bare - # `reqwest::Client`, so it trusted only the platform roots and died at - # `invalid peer certificate: UnknownIssuer` against a swarm whose - # authelia is signed by the swarm CA — while this very bundle sat on - # disk, already assembled, already handed to hive-c0re under a different - # variable name. The anchor was never missing; nothing pointed the queue - # client at it. + # ⚠️ `swarm-queue-client` builds a bare `reqwest::Client`, so it trusts + # only the platform roots and dies at `invalid peer certificate: + # UnknownIssuer` against a swarm whose authelia is signed by the swarm + # CA. The bundle is already assembled on disk and handed to hive-c0re + # under a different variable name; this declaration is what points the + # queue client at it. # # Where the gateway is not self-signed this module contributes nothing, and # the clients then fall back to the platform roots — which is correct for diff --git a/nix/host-modules/hyperhive.nix b/nix/host-modules/hyperhive.nix index f240ca75..8d92f381 100644 --- a/nix/host-modules/hyperhive.nix +++ b/nix/host-modules/hyperhive.nix @@ -11,8 +11,8 @@ let hiveCfg = config.services.hyperhive; in { - # The swarm's display name moved under `swarm` when the swarm-global - # settings were consolidated; the hive's own name and domain stayed put, + # The swarm's display name lives under `swarm`, with the other + # swarm-global settings; the hive's own name and domain are top-level, # because they describe this hive rather than the swarm it joins. imports = [ (lib.mkRenamedOptionModule @@ -39,11 +39,10 @@ in # "the other hives can't reach me", on a machine other than the # misconfigured one. # - # ⚠️ The `.` formula did NOT move here from - # there and back: it lives once, on `hives..domain`, which - # this reads. Restoring a direct fallback here would recreate the - # second path (and, since that default reads `swarm.domain` too, a - # value that can differ from the directory's). + # ⚠️ The `.` formula lives once, on + # `hives..domain`, which this reads. A direct fallback here + # would recreate the second path (and, since that default reads + # `swarm.domain` too, a value that can differ from the directory's). default = if hiveCfg.hiveName != null && hiveCfg.swarm.hives ? ${hiveCfg.hiveName} then hiveCfg.swarm.hives.${hiveCfg.hiveName}.domain diff --git a/nix/host-modules/swarm-authelia-service.nix b/nix/host-modules/swarm-authelia-service.nix index 6e27846c..614ce3a8 100644 --- a/nix/host-modules/swarm-authelia-service.nix +++ b/nix/host-modules/swarm-authelia-service.nix @@ -18,7 +18,7 @@ let unitName = "authelia-${instance}"; in { - # `enable` and both packages moved to `services.hyperhive.deploy.authelia` + # `enable` and both packages are under `services.hyperhive.deploy.authelia` # — see ./deploy.nix. Whether this host runs the swarm's SSO provider, and # which build it runs, are deployment decisions, in ./swarm-authelia.nix. # Here is what authelia IS, including `url` and the OIDC client registry diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix index 49c8e6e0..8e6de00e 100644 --- a/nix/host-modules/swarm-bao.nix +++ b/nix/host-modules/swarm-bao.nix @@ -2914,9 +2914,8 @@ in # difference between a mount nobody may issue from and one the gateway's # certificate comes out of. # - # The policy text moved here from the controller's unit, where it sat - # while it attached to nothing — a policy and the role that carries it - # belong in one place, and now there is a principal to put them with. + # The policy text lives beside the role that carries it: a policy and + # its role belong in one place, with the principal they grant. systemd.services.swarm-bao-services-issuer-policy = lib.mkIf haveGranter { description = "write the swarm services issuer's bao policy and cert-auth role"; after = [ diff --git a/nix/host-modules/swarm-controller.nix b/nix/host-modules/swarm-controller.nix index 0fb776f3..b76f85a3 100644 --- a/nix/host-modules/swarm-controller.nix +++ b/nix/host-modules/swarm-controller.nix @@ -375,13 +375,14 @@ in ''; }; - # `enable` moved to `services.hyperhive.deploy.swarm-controller.enable` — see - # ./deploy.nix. `services.hyperhive.deploy.singleHostSwarm` still - # asserts it, and that was never an exception to "not derived from + # `enable` is `services.hyperhive.deploy.swarm-controller.enable` — see + # ./deploy.nix. `services.hyperhive.deploy.singleHostSwarm` asserts + # it, and that is not an exception to "not derived from # deploy.hive-controller.enable": that mode says "this box is the whole # deployment", which answers the topology question outright, where - # `enable` alone never can. Both packages moved to that same - # `deploy.swarm-controller` block. What stays here is what the daemon IS. + # `enable` alone never can. Both packages are in that same + # `deploy.swarm-controller` block. What is declared here is what the + # daemon IS. staleAfterSeconds = lib.mkOption { type = lib.types.ints.positive; @@ -612,8 +613,8 @@ in matrixHomeserverUrl = lib.mkOption { type = lib.types.nullOr lib.types.str; # `gatewayHost`'s own vhost, not a re-derivation of its default: a - # deployment that pins `gatewayHost` (e.g. to keep a name from before - # it moved under the swarm domain) still has one homeserver, and this + # deployment that pins `gatewayHost` (e.g. to the per-hive name) still + # has one homeserver, and this # option has to name the same one. default = if matrixCfg.gatewayHost == null then null else "https://${matrixCfg.gatewayHost}"; defaultText = lib.literalExpression ''"https://''${services.hyperhive.swarm.matrix.gatewayHost}"''; diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix index bbbd032d..6750db4e 100644 --- a/nix/host-modules/swarm-grafana.nix +++ b/nix/host-modules/swarm-grafana.nix @@ -277,7 +277,7 @@ in # store path, and the directory it shares a socket with nginx through. # `enable` already lives in ./deploy.nix, which also carries the renames. # - # ⚠️ Both datasource URLs are wiring and still move. A URL's scope is the + # ⚠️ Both datasource URLs are wiring, so they live here. A URL's scope is the # scope of what it ADDRESSES, not the fact that it is a URL: both stores # bind loopback, so these can only ever mean "on this host". options.services.hyperhive.deploy.grafana = { diff --git a/nix/host-modules/swarm-nats.nix b/nix/host-modules/swarm-nats.nix index 439f2d33..9dd1f871 100644 --- a/nix/host-modules/swarm-nats.nix +++ b/nix/host-modules/swarm-nats.nix @@ -118,14 +118,13 @@ let # Two accounts, and the callout user lives in neither of the accounts # it authorizes into. accounts = { - # ⚠️ The nkey is not decoration and its absence was a real hole: a + # ⚠️ The nkey is not decoration, and without it there is a hole: a # `users` entry carrying only a `user` name has no credential, and # `CONNECT {"user":"auth"}` is then accepted with no password at # all. Since the name is a literal in this public module, that made # the callout-exempt identity walk-in-able from every container on # the shared netns — the same class of hole this module exists to - # close, moved rather than fixed. Caught in review on the first - # version of this file. An nkey and NOTHING else, both halves + # close. An nkey and NOTHING else, both halves # measured against a running server rather than reasoned about: # # { user = "auth"; } → `CONNECT {"user":"auth"}` diff --git a/nix/host-modules/swarm-otel-service.nix b/nix/host-modules/swarm-otel-service.nix index 3bccbc56..edea88cb 100644 --- a/nix/host-modules/swarm-otel-service.nix +++ b/nix/host-modules/swarm-otel-service.nix @@ -41,7 +41,7 @@ in '') ]; - # `enable` moved to `services.hyperhive.deploy.swarm-otel.enable` — see ./deploy.nix. + # `enable` is `services.hyperhive.deploy.swarm-otel.enable` — see ./deploy.nix. # ⚠️ That is the SWARM collector. The per-hive one keeps its own # `services.hyperhive.otel.enable` (./otel.nix) and is a different # option entirely — every hive runs that one. diff --git a/nix/host-modules/swarm-otel.nix b/nix/host-modules/swarm-otel.nix index 05986f69..4feaf785 100644 --- a/nix/host-modules/swarm-otel.nix +++ b/nix/host-modules/swarm-otel.nix @@ -555,8 +555,8 @@ in # that runs it without a leaf, because a Grafana with no SSO has no way # in at all, while a collector with none still receives telemetry. So # this fires only where the host already reads the store and is missing - # this one pair — which before the four-way split rendered the unit off - # `clientCertFile`, and now silently does not. + # this one pair: the unit is rendered off the collector's own leaf, so + # without it the unit would silently not render. assertion = !hiveReaderIdentity || haveClientIdentity; message = '' This host reads the swarm secret store (services.hyperhive.deploy.bao.clientCertFile @@ -586,10 +586,10 @@ in from that CA out of band and named here — see docs/swarm/secrets.md. ''; } - # ⚠️ An assertion that this collector has "somewhere to send" was REMOVED - # rather than relaxed: it read the store's *per-host* enable, so it - # rejected at eval the very deployment the stores are reached by domain - # for — a collector on its own host never built. + # ⚠️ There is deliberately no assertion that this collector has + # "somewhere to send": it would read the store's *per-host* enable, and + # so reject at eval the very deployment the stores are reached by domain + # for — a collector on its own host would never build. { # Whether there is a journal on disk to collect from. # A `bindMounts` entry never creates its `hostPath`, and unlike diff --git a/nix/host-modules/swarm-ui.nix b/nix/host-modules/swarm-ui.nix index b1d32a6a..c168e409 100644 --- a/nix/host-modules/swarm-ui.nix +++ b/nix/host-modules/swarm-ui.nix @@ -61,10 +61,10 @@ let apex = if swarmCfg.domain == null then "swarm.invalid" else swarmCfg.domain; in { - # `enable` moved to `services.hyperhive.deploy.swarm-ui.enable` — see - # ./deploy.nix, where it still derives from the controller's own deploy - # toggle for the same reason. `domain` is gone too: the UI answers on the - # swarm apex, which the swarm already declares once. + # `enable` is `services.hyperhive.deploy.swarm-ui.enable` — see + # ./deploy.nix, where it derives from the controller's own deploy + # toggle for the same reason. There is no `domain` option: the UI answers + # on the swarm apex, which the swarm already declares once. imports = [ (lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "ui" "domain" ] '' The swarm UI answers on services.hyperhive.swarm.domain and nothing diff --git a/nix/host-modules/swarm.nix b/nix/host-modules/swarm.nix index 28b4f883..04e5b864 100644 --- a/nix/host-modules/swarm.nix +++ b/nix/host-modules/swarm.nix @@ -211,7 +211,7 @@ in # it — and this field was set on real deployments. # # ⚠️ `lib.mkRemovedOptionModule` cannot do this job here, and - # neither of its two halves survives the move into a submodule: + # neither of its two halves survives inside a submodule: # its `apply = throw` fires only when the value is READ, and # nothing reads this (that being the point of removing # it); its `config.assertions` half would land on a submodule diff --git a/nix/module-eval/bao-otel-collector.nix b/nix/module-eval/bao-otel-collector.nix index e340df55..f94a1c8a 100644 --- a/nix/module-eval/bao-otel-collector.nix +++ b/nix/module-eval/bao-otel-collector.nix @@ -334,7 +334,7 @@ let && (baoForwarder baoWithHiveOtel).settings.exporters.otlphttp.endpoint == route; } { - # 🎯 The credential half of this move, and the arm that says the hop + # 🎯 The credential half of the hop, and the arm that says it # DELIVERS rather than merely resolves. The receiver at the far end # takes an OIDC token and nothing else, so an exporter with no # authenticator is a forwarder that retries into 401s while every other diff --git a/nix/module-eval/name-guards.nix b/nix/module-eval/name-guards.nix index e1b7abea..e206d24a 100644 --- a/nix/module-eval/name-guards.nix +++ b/nix/module-eval/name-guards.nix @@ -229,7 +229,7 @@ let ok = !(equalityGuardFired hiveNamesAllLegal) && !(fragmentGuardFired hiveNamesAllLegal); } { - # The substring guard came along in the move and has to still work. + # The substring guard has to work with the collector off too. # `h1-agent` mints exactly the client id hive `h1`'s agents present. name = "a hive name containing a composed-identifier word is refused, with the collector off"; ok = fragmentGuardFired hiveNameWithComposedWord; diff --git a/nix/module-eval/nats-authelia.nix b/nix/module-eval/nats-authelia.nix index 6f82f382..9a388589 100644 --- a/nix/module-eval/nats-authelia.nix +++ b/nix/module-eval/nats-authelia.nix @@ -268,9 +268,9 @@ let } { # Not a rename test. `hostClientSecretDir` is `readOnly`, so the fixture - # cannot define it; what can break is a reader left pointing at the - # namespace it moved out of. Several modules read this through an - # `autheliaCfg` alias, where a path-shaped grep does not see it. + # cannot define it; what can break is a reader left pointing at + # `swarm.authelia` instead of `deploy.authelia`. Several modules read this + # through an `autheliaCfg` alias, where a path-shaped grep does not see it. name = "a consumer of authelia's host client-secret dir renders it from the deploy namespace"; ok = lib.hasPrefix "/var/lib/nixos-containers/swarm-authelia/var/lib/authelia-swarm/oidc-clients/" autheliaOldPath.services.hyperhive.otel.clientSecretFile; } @@ -332,10 +332,11 @@ let } { # …and the name it resolves through is a DOMAIN, not a host this config - # picked. `127.0.0.1` is what the old default rendered on the IdP host, - # the bridge address is what the queue's defaults still render, and - # neither is an address a client may be handed: the domain is allowed to - # resolve differently in different places, which is the whole property. + # picked. `127.0.0.1` is what a co-location-derived default renders on + # the IdP host, the bridge address is what the queue's defaults render, + # and neither is an address a client may be handed: the domain is + # allowed to resolve differently in different places, which is the + # whole property. name = "the swarm IdP address names no host address"; ok = let