vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

fix the builder cache module-eval case and document the external cache

Browse source
This commit is contained in:
atlas 2026-10-27 11:36:19 +01:00
commit f59ed01353
2 changed files with 27 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

24
docs/swarm/builder.md
View file

@ -294,6 +294,30 @@ Mixed versions:
A record written before the field existed also reads as `false`.
### External cache
The cache can be an attic tenant on an instance outside the swarm. To point
the swarm at an existing tenant:
1. On the builder host, set `services.hyperhive.swarm.attic.domain` to the
instance's host name (no scheme, `host:port` if it isn't on 443) and
`services.hyperhive.swarm.attic.cache` to the cache's name on it.
2. Seed the push token in the swarm secret store at
`secret/swarm/services/attic/push-token`, field `value`. Use the store's UI,
or `bao kv put` with `value=-` and the token on stdin, so the token is in no
command line. The token needs push rights on that cache. Until it
exists, every push fails and builds stay green with `cached` false.
The builder checks the instance's certificate against the system roots and
pins nothing, so a Let's Encrypt certificate needs no setup. The builder
reads the token again on every push, so a new token takes effect on the next
build.
A later change adds the swarm's own attic service: `deploy.attic.enable` will run atticd
in the swarm and fill these two options itself. An operator who sets that option
to false keeps the external cache by setting the two options by hand and
seeding the token as above.
## Credentials
| What | Where | Who reads it |

6
nix/module-eval/builder.nix
View file

@ -145,12 +145,12 @@ let
ok =
env.SWARM_BUILDER_ATTIC_DOMAIN == "cache.example.org"
&& env.SWARM_BUILDER_ATTIC_CACHE == "grid"
&& hasOnPath "attic-client" svc
&& hasOnPath "attic" svc
&& svc.serviceConfig.RuntimeDirectory == "swarm-builder"
&& svc.serviceConfig.RuntimeDirectoryMode == "0700"
&& !(lib.any (lib.hasInfix "TOKEN") (lib.attrNames env))
&& !(lib.any (lib.hasSuffix "TOKEN") (lib.attrNames env))
&& hasOnPath "git" withoutCache
&& !(hasOnPath "attic-client" withoutCache)
&& !(hasOnPath "attic" withoutCache)
&& !(withoutCache.environment ? SWARM_BUILDER_ATTIC_DOMAIN)
&& !(withoutCache.environment ? SWARM_BUILDER_ATTIC_CACHE);
}