vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: run swarm-ui wherever swarm-controller runs

Browse source 
Remove deploy.swarm-ui.enable. Every reader (the swarm-ui vhost, the
authelia operator rule for the swarm apex, hive-network's
anyServiceEnabled) now reads deploy.swarm-controller.enable, and the
controller's webhook public URL is gated on the swarm domain alone,
since the vhost it names exists wherever the daemon does.

Both spellings of the old switch (deploy.swarm-ui.enable and the
already-renamed swarm.ui.enable) become mkRemovedOptionModule entries,
so a host that still sets either fails evaluation with a message
naming the controller toggle instead of silently changing.

Ruling (mara, #3742): "swarm-ui always runs wherever controller runs".

Part of #3742
This commit is contained in:
atlas 2026-10-13 08:19:35 +02:00 • committed by mara
commit f9954b91b4
10 changed files with 83 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

34
nix/module-eval/swarm-services-switch.nix
View file

@ -70,13 +70,19 @@ let
network.exposeHostPorts = [ 5432 ];
};
# The swarm UI where its own toggle is on — the control the absence arm
# The swarm UI on the controller's host — the control the absence arm
# needs, since nothing else in this suite renders this vhost and an arm
# saying "it is not there" would hold just as well if it were never there.
# Package stubbed per this file's header: the vhost roots at it.
#
# Also sets both removed UI switches to `false`: the vhost must render
# regardless, and each must fail evaluation through its assertion. Neither
# is read anywhere else, so they change nothing the other arms see.
swarmUiHere = hive {
deploy.swarm-ui.enable = true;
deploy.swarm-controller.enable = true;
deploy.swarm-ui.package = pkgs.emptyDirectory;
deploy.swarm-ui.enable = false;
swarm.ui.enable = false;
};
# The swarm's shared services hosted HERE without the all-local mode — a
@ -224,7 +230,7 @@ let
name = "hosting the swarm's shared services does not make a hive the swarm's control plane";
ok =
!swarmServicesHere.services.hyperhive.deploy.swarm-controller.enable
&& !swarmServicesHere.services.hyperhive.deploy.swarm-ui.enable;
&& !(swarmServicesHere.services.nginx.virtualHosts ? "t.local");
}
{
# Control for the arm above, and the one place this slice is not inert:
@ -235,9 +241,29 @@ let
ok = builtins.elem 5432 (bridgePortsOrNone exposedPortsNoHive);
}
{
name = "the swarm UI claims the swarm apex where this host serves it";
name = "the swarm UI claims the swarm apex wherever this host runs the swarm controller";
ok = swarmUiHere.services.nginx.virtualHosts ? "t.local";
}
{
# Control: `swarmServicesHere` sets neither removed switch.
name = "a definition of a removed swarm UI switch fails evaluation, naming the option and the controller";
ok =
let
refused =
m: path:
lib.any (
a:
!a.assertion
&& lib.hasInfix "services.hyperhive.${path}" a.message
&& lib.hasInfix "swarm-ui now runs wherever swarm-controller runs" a.message
) m.assertions;
paths = [
"deploy.swarm-ui.enable"
"swarm.ui.enable"
];
in
lib.all (refused swarmUiHere) paths && !(lib.any (refused swarmServicesHere) paths);
}
{
# The swarm-services toggle enables them explicitly, from its own
# module rather than from any of their defaults.