vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: set the hive-controller option only in tests that need a hive

Browse source 
The shared `hive` fixture turned `deploy.hive-controller.enable` on for
every eval test. It is now off by default; `hiveWithController` turns it
on, and the fixtures whose claims read the hive tier (hive-c0re, the
queue-agent credential, the hive leaf, `deploy.hive-controller.*`, or an
absence that is only meaningful with a hive present) use it.

glue-nats-auth-bao-identity.nix still read the renamed
`services.hyperhive.enable`, which printed the "Obsolete option" trace
six times per CI run. The term is dropped: the pairing is gated on the
queue and the minted PKI, as its sibling glue-nats-bao-identity.nix is.
This commit is contained in:
atlas 2026-10-05 02:27:33 +02:00 • committed by mara
commit ea63b0d150
10 changed files with 47 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/module-eval/hive-tls.nix
View file

@ -21,26 +21,26 @@ let
nixosSystem
;
})
hive
hiveWithController
runGroup
;
# Every service on one host, so the store's granting unit renders the role
# this leaf is issued through.
allLocal = hive {
allLocal = hiveWithController {
deploy.singleHostSwarm = true;
};
# The same host with the role's lifetime moved, so a threshold that is a
# number of its own shows up as one that did not move with it.
shortTtl = hive {
shortTtl = hiveWithController {
deploy.singleHostSwarm = true;
deploy.bao.servicesPkiLeafTtlHours = 48;
};
# Fronting none of the swarm's names, reading a store it does not run,
# with the reader identity and the hive's own identity placed by hand.
noService = hive {
noService = hiveWithController {
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
deploy.bao.serverCaFile = "/etc/pki/bao-ca.pem";
@ -50,7 +50,7 @@ let
noSvcFetch = noService.systemd.services.swarm-services-cert.script;
# The same hive with no store identity at all.
noIdentity = hive { };
noIdentity = hiveWithController { };
noIdFetch = noIdentity.systemd.services.swarm-services-cert.script;
# The `want_svc=0` branch of a rendered script, up to the `fi` that closes it (the