vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

swarm: run the agent queue credential reader before hive-c0re

Browse source 
Ruled: swarm-bao-queue-agent.service must run before hive-c0re.service
and be wanted (not required) by it, so no agent container renders
ahead of the reader's attempt at its credential. An unreachable store
delays hive-c0re's start by the reader's own start-limit window rather
than failing it outright.

Refs #4314
This commit is contained in:
atlas 2026-09-13 00:57:59 +02:00 • committed by mara
commit f8dd737456
3 changed files with 31 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/host-modules/glue-queue-agent-credential.nix
View file

@ -103,11 +103,17 @@ in
];
wants = lib.optionals baoDeploy.enable [ "container@${baoCfg.machine}.service" ];
requires = lib.optionals baoDeploy.enable [ "swarm-bao-pki.service" ];
# Ordered `Before=` nothing, because the consumer does not exist yet.
# Agent containers are created at runtime, so no static unit name can be
# named here anyway; the slice that bind-mounts these files in adds the
# edge through hive-c0re's `container@h-<agent>.service` drop-in.
wantedBy = [ "multi-user.target" ];
# Ordered before hive-c0re, so no agent container renders ahead of an
# attempt at its credential. `Wants=`, not `Requires=`: a store this
# unit can't reach delays hive-c0re's start by its own start-limit
# window (`TimeoutStartSec`, retried up to `startLimitBurst` times
# below) rather than failing it — hive-c0re starts once that window
# elapses, whatever credential is or isn't on disk by then.
before = [ "hive-c0re.service" ];
wantedBy = [
"multi-user.target"
"hive-c0re.service"
];
path = [
baoDeploy.package
pkgs.coreutils