18ed3f5040
Thirty-three module-eval fixtures were a second (or later) full `nixosSystem` evaluation of a config another fixture already evaluated: 16 shapes defined identically in two to seven cluster files, plus duplicates inside agent-queue-bao, core-toggle and swarm-services-switch. Each cluster imports ./lib.nix itself, so nothing was shared between them. nix/module-eval/shared.nix now defines each of those 16 shapes once. nix/checks.nix instantiates it a single time and passes it as `shared` to the 23 clusters that read one, and each cluster rebinds the fixture under its existing local name. Assertions are unchanged. Case text changes only in core-toggle, where two cases built the forge-host fixture inline and now read the file's `forgeHere`, and in two inline `let` bindings (bao-otel-collector, grafana) that now take the shared fixture. Six folds are value-equal rather than textually equal: they drop an explicit `deploy.hive-controller.enable = false` or `deploy.swarm-otel.enable = false` that equals what the option already resolves to for that config. Nothing under nix/host-modules sets either option apart from the `mkDefault allSwarmServices` on swarm-otel, and the only option-priority read there is `domain.highestPrio`. Part of #5171.
96 lines
3 KiB
Nix
96 lines
3 KiB
Nix
# The fixtures more than one `checks.module-eval-*` cluster reads, each
|
|
# evaluated once. ../checks.nix imports this file once and hands the result to
|
|
# every cluster that uses one; a cluster rebinds the fixture under its own
|
|
# local name.
|
|
#
|
|
# ⚠️ Sharing only pays when ../checks.nix instantiates this file ONCE: a
|
|
# cluster that ran `import ./shared.nix` itself would get its own copy of
|
|
# every fixture, the same as defining them locally. The cost is that each
|
|
# fixture here stays live for the whole evaluation rather than one cluster's.
|
|
#
|
|
# Holds only configs that are identical across their users. A cluster whose
|
|
# claim needs one more option set defines its own fixture.
|
|
{
|
|
pkgs,
|
|
lib,
|
|
self,
|
|
nixosSystem,
|
|
}:
|
|
let
|
|
inherit
|
|
(import ./lib.nix {
|
|
inherit
|
|
pkgs
|
|
lib
|
|
self
|
|
nixosSystem
|
|
;
|
|
})
|
|
hive
|
|
hiveWithController
|
|
agent
|
|
agentWith
|
|
;
|
|
in
|
|
{
|
|
agentBare = agent { };
|
|
|
|
agentWithBao = agentWith { services.hyperhive.agent.bao.addr = "https://bao.t.local:8200"; };
|
|
|
|
bare = hive { };
|
|
|
|
bareWithController = hiveWithController { };
|
|
|
|
allLocal = hiveWithController { deploy.singleHostSwarm = true; };
|
|
|
|
autheliaOnly = hive { deploy.authelia.enable = true; };
|
|
|
|
forgeHere = hive { deploy.forgejo.enable = true; };
|
|
|
|
baoOnly = hive { deploy.bao.enable = true; };
|
|
|
|
servicesHere = hive { deploy.allSwarmServices = true; };
|
|
|
|
controllerAlone = hive { deploy.swarm-controller.enable = true; };
|
|
|
|
matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };
|
|
|
|
baoWithMatrix = hiveWithController {
|
|
deploy.bao.enable = true;
|
|
deploy.matrix.enable = true;
|
|
};
|
|
|
|
# A second job declared as bare `host:port`, so a case can read one rendered
|
|
# scrape list where the store's entry carries a path and this one carries
|
|
# none.
|
|
baoWithCollector = hive {
|
|
deploy.bao.enable = true;
|
|
deploy.swarm-otel.enable = true;
|
|
swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
|
|
};
|
|
|
|
# `clientSecretFile` is what ../host-modules/otel.nix's identity assertion
|
|
# demands of any hive with the tier on.
|
|
baoWithHiveOtel = hive {
|
|
deploy.bao.enable = true;
|
|
otel.enable = true;
|
|
otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
|
|
};
|
|
|
|
# The swarm collector with the IdP on another host and the store leaf placed
|
|
# by hand, without and with the collector's own OIDC pair.
|
|
otelReaderMissingLeaf = hive {
|
|
deploy.swarm-otel.enable = true;
|
|
swarm.authelia.url = "https://auth.example.invalid";
|
|
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
|
|
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
|
|
};
|
|
otelReaderNamedInFull = hive {
|
|
deploy.swarm-otel.enable = true;
|
|
swarm.authelia.url = "https://auth.example.invalid";
|
|
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
|
|
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
|
|
deploy.bao.otelOidcClientCertFile = "/etc/pki/bao-otel-oidc.pem";
|
|
deploy.bao.otelOidcClientKeyFile = "/etc/pki/bao-otel-oidc-key.pem";
|
|
};
|
|
}
|