nix/host-modules/deploy.nix

@@ -69,6 +69,10 @@ in
       [ "services" "hyperhive" "swarm" "controller" "enable" ]
       [ "services" "hyperhive" "deploy" "swarm-controller" "enable" ]
     )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "controller" "socketPath" ]
+      [ "services" "hyperhive" "deploy" "swarm-controller" "socketPath" ]
+    )
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "controller" "forgeTokenFile" ]
       [ "services" "hyperhive" "deploy" "swarm-controller" "forgeTokenFile" ]

nix/host-modules/swarm-controller.nix

@@ -447,7 +447,6 @@ in
     socketPath = lib.mkOption {
       type = lib.types.str;
       default = "/run/swarm-controller/controller.sock";
-      readOnly = true;
       description = ''
         Unix socket the daemon serves on, and the path the gateway's nginx
         proxies to.

nix/module-eval.nix

@@ -201,12 +201,13 @@ let
     deploy.matrix.maxRequestSize = 99000000;
   };
 
-  # `enable` is spelled the OLD way like everything else here, so all six
-  # of the controller's shims are exercised rather than five.
+  # `enable` is spelled the OLD way like everything else here, so all seven
+  # of the controller's shims are exercised rather than six.
   controllerOldPath = hive {
     swarm.controller.enable = true;
     swarm.controller.package = pkgs.emptyDirectory;
     swarm.controller.swarmctlPackage = pkgs.emptyDirectory;
+    swarm.controller.socketPath = "/run/test-ctrl/ctrl.sock";
     swarm.controller.forgeTokenFile = "/run/secrets/ctrl-forge.token";
     swarm.controller.authBridgeUrl = "http://127.0.0.1:19097";
     swarm.controller.queue.clientSecretFile = "/run/secrets/ctrl-queue.secret";
@@ -961,25 +962,19 @@ let
       # Reads the host's tmpfiles rules, not the options: the socket directory
       # nginx and the container share is created there, so a rename that
       # resolved but stopped reaching the module would leave the gateway
-      # proxying to a path nothing creates. All three old paths are defined
-      # in the fixture, so removing any single shim fails the eval rather
-      # than only the one this assertion reads.
-      # THREE movers (authBridgeUrl, forgeTokenFile, queue.clientSecretFile)
-      # are asserted as rendered effects rather than as option values, so a
-      # rename that resolved but stopped reaching the module is caught
-      # per-option instead of only where one assertion happens to look.
-      # socketPath is no longer one of them: it went readOnly and lost its
-      # shim in the same slice, so it has no pre-rename path left to prove
-      # reaches the unit — the SOCKET line below instead pins the one value
-      # it can ever hold, the default, so the env var vanishing or being
-      # misspelled still fails this arm.
+      # proxying to a path nothing creates. All four old paths are defined in
+      # the fixture, so removing any single shim fails the eval rather than
+      # only the one this assertion reads.
+      # All FOUR movers are asserted as rendered effects rather than as option
+      # values, so a rename that resolved but stopped reaching the module is
+      # caught per-option instead of only where one assertion happens to look.
       name = "a config written against the pre-rename swarm-controller paths still reaches the unit";
       ok =
         let
           u = controllerOldPath.systemd.services.swarm-controller;
           creds = u.serviceConfig.LoadCredential;
         in
-        u.environment.SWARM_CONTROLLER_SOCKET == "/run/swarm-controller/controller.sock"
+        u.environment.SWARM_CONTROLLER_SOCKET == "/run/test-ctrl/ctrl.sock"
         && u.environment.SWARM_CONTROLLER_AUTH_BRIDGE_URL == "http://127.0.0.1:19097"
         && lib.any (c: lib.hasInfix "/run/secrets/ctrl-queue.secret" c) creds
         && lib.any (c: lib.hasInfix "/run/secrets/ctrl-forge.token" c) creds;