vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

swarm-controller: make socketPath readOnly instead of asserting it

Browse source 
readOnly makes a bad socketPath inexpressible rather than diagnosed
after the fact. Since readOnly rejects any definition including one
arriving through a rename shim, drop the deploy.nix rename entry for
it and the fixture line exercising it, and update the controllerOldPath
comment's shim count from seven to six.

Refs #4208
This commit is contained in:
atlas 2026-09-17 19:00:12 +02:00
commit fcb8a594bb
3 changed files with 3 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/host-modules/deploy.nix
View file

@ -69,10 +69,6 @@ in
[ "services" "hyperhive" "swarm" "controller" "enable" ]
[ "services" "hyperhive" "deploy" "swarm-controller" "enable" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "swarm" "controller" "socketPath" ]
[ "services" "hyperhive" "deploy" "swarm-controller" "socketPath" ]
)
(lib.mkRenamedOptionModule
[ "services" "hyperhive" "swarm" "controller" "forgeTokenFile" ]
[ "services" "hyperhive" "deploy" "swarm-controller" "forgeTokenFile" ]

21
nix/host-modules/swarm-controller.nix
View file

@ -447,6 +447,7 @@ in
socketPath = lib.mkOption {
type = lib.types.str;
default = "/run/swarm-controller/controller.sock";
readOnly = true;
description = ''
Unix socket the daemon serves on, and the path the gateway's nginx
proxies to.
@ -720,26 +721,6 @@ in
state directory.
'';
}
{
assertion =
let
dir = builtins.dirOf deployCfg.swarm-controller.socketPath;
in
dir != "/run/hyperhive" && dir != "/run/hive" && dir != "/run";
message = ''
services.hyperhive.deploy.swarm-controller.socketPath puts the
controller socket in
${builtins.dirOf deployCfg.swarm-controller.socketPath}, a
directory that carries other sockets.
The controller socket is 0666 and the gateway's nginx is given
its directory, so that directory is the access control.
/run/hyperhive holds host.sock — the host ADMIN socket — and
/run/hive holds the per-agent and priv sockets. Give the
controller a directory of its own (the default,
/run/swarm-controller, is one).
'';
}
];
systemd.services.swarm-controller = {

5
nix/module-eval.nix
View file

@ -201,13 +201,12 @@ let
deploy.matrix.maxRequestSize = 99000000;
};
# `enable` is spelled the OLD way like everything else here, so all seven
# of the controller's shims are exercised rather than six.
# `enable` is spelled the OLD way like everything else here, so all six
# of the controller's shims are exercised rather than five.
controllerOldPath = hive {
swarm.controller.enable = true;
swarm.controller.package = pkgs.emptyDirectory;
swarm.controller.swarmctlPackage = pkgs.emptyDirectory;
swarm.controller.socketPath = "/run/test-ctrl/ctrl.sock";
swarm.controller.forgeTokenFile = "/run/secrets/ctrl-forge.token";
swarm.controller.authBridgeUrl = "http://127.0.0.1:19097";
swarm.controller.queue.clientSecretFile = "/run/secrets/ctrl-queue.secret";