vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: finish the current-behaviour comment sweep in touched files

Browse source 
Rewrite the remaining narration in files the previous commit touched:
"moved"/"sat"/"was REMOVED"/"old default" comments in swarm-bao,
swarm-otel, glue-bao-tls, nats-authelia, swarm-controller, swarm-ui,
swarm-otel-service, swarm-authelia-service, the deploy.nix rename table,
hive-ci, hive-forge/service, hive-tls, hyperhive, swarm-nats, swarm.nix
and a few module-eval fixtures, so each says where a thing is or why it
is so now.

Revert the comment edits inside shell script strings in hive-tls,
swarm-nats and the forge token mint to their previous text, so those
generated units are unchanged. The only unit still changing is
swarm-bao-pki (two comment lines in its script). Refs #3902
This commit is contained in:
atlas 2026-10-05 03:13:02 +02:00
commit e990e9a0be
21 changed files with 102 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

21
nix/host-modules/hive-tls.nix
View file

@ -130,9 +130,9 @@ let
# leaf to hold, and its absence there is the correct state rather
# than a stale one — its own vhosts are covered by the hive leaf
# above. Anywhere else it is expected: the leaf comes from the
# secret store's `pki` mount, reachable from every host rather than
# from a sub-CA on one host in the swarm, so "this host cannot issue
# it" is not one of the answers.
# secret store's `pki` mount now, not from a sub-CA that exists on
# one host in the swarm, so "this host cannot issue it" is no longer
# one of the answers.
want_svc=${if localServiceDomains == [ ] then "0" else "1"}
# Expiry is not the only way a leaf goes wrong. One signed when the
@ -976,15 +976,14 @@ in
# they mint a token from authelia over TLS. Declared HERE, beside the
# bundle, rather than in each consumer's module: the path is this
# module's fact, and two consumers re-deriving `${stateDir}/…` would be
# two places to fix the day it moves.
# two places to fix when it changes.
#
# ⚠️ This is what was missing. `swarm-queue-client` built a bare
# `reqwest::Client`, so it trusted only the platform roots and died at
# `invalid peer certificate: UnknownIssuer` against a swarm whose
# authelia is signed by the swarm CA — while this very bundle sat on
# disk, already assembled, already handed to hive-c0re under a different
# variable name. The anchor was never missing; nothing pointed the queue
# client at it.
# ⚠️ `swarm-queue-client` builds a bare `reqwest::Client`, so it trusts
# only the platform roots and dies at `invalid peer certificate:
# UnknownIssuer` against a swarm whose authelia is signed by the swarm
# CA. The bundle is already assembled on disk and handed to hive-c0re
# under a different variable name; this declaration is what points the
# queue client at it.
#
# Where the gateway is not self-signed this module contributes nothing, and
# the clients then fall back to the platform roots — which is correct for