86 lines
3.8 KiB
Nix
86 lines
3.8 KiB
Nix
# The binary cache the swarm pushes agent closures to, as every host sees it:
|
|
# which attic server, and which cache on it. Both default to the swarm's own,
|
|
# which the host that sets `deploy.attic.enable` runs (./swarm-attic.nix); an
|
|
# operator with an instance outside the swarm overrides both.
|
|
{ lib, config, ... }:
|
|
let
|
|
swarmDomain = config.services.hyperhive.swarm.domain;
|
|
|
|
# Total on a null swarm domain, as every sibling module is: the
|
|
# required-domain assertion in hive-network.nix is what an operator should
|
|
# see, not a coercion error from here.
|
|
domainBase = if swarmDomain == null then "invalid" else swarmDomain;
|
|
in
|
|
{
|
|
options.services.hyperhive.swarm.attic = {
|
|
otel.clientId = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
default = "swarm-attic-collector";
|
|
description = ''
|
|
OAuth2 client id the journal forwarder inside the cache's container
|
|
authenticates as, and the audience it asks its token for.
|
|
|
|
Read-only because three hosts have to agree on it: authelia registers
|
|
the client (`glue-attic-otel-oidc-client.nix`), the swarm collector
|
|
admits it on the container's receiver (`swarm.otel.serviceProducers`),
|
|
and the secret publisher carries its secret to the store.
|
|
'';
|
|
};
|
|
|
|
ownDomain = lib.mkOption {
|
|
type = lib.types.str;
|
|
readOnly = true;
|
|
default = "attic.${domainBase}";
|
|
defaultText = lib.literalExpression ''"attic.''${services.hyperhive.swarm.domain}"'';
|
|
description = ''
|
|
Read-only: the name the swarm's own cache is served under, which
|
|
{option}`services.hyperhive.swarm.attic.domain` defaults to. A sibling of the
|
|
swarm's other service names, so the swarm-services sub-CA can issue for it,
|
|
and in `swarm.serviceDomains` on every host whether or not one runs it.
|
|
'';
|
|
};
|
|
|
|
domain = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = config.services.hyperhive.swarm.attic.ownDomain;
|
|
defaultText = lib.literalExpression "services.hyperhive.swarm.attic.ownDomain";
|
|
example = "cache.example.org";
|
|
description = ''
|
|
Name of the attic server, with no scheme: the swarm builder pushes to
|
|
`https://<domain>`, and trusts the certificate the system roots do, so
|
|
a Let's Encrypt certificate works and none is pinned. Set together with
|
|
{option}`services.hyperhive.swarm.attic.cache`; evaluation fails when only
|
|
one is set.
|
|
|
|
Defaults to the swarm's own cache, the same on every host. For a cache
|
|
outside the swarm, override both options and leave
|
|
{option}`services.hyperhive.deploy.attic.enable` unset. With no cache
|
|
behind the default, a push fails and the closure record says it is not
|
|
cached.
|
|
|
|
Null pushes nothing: the swarm builder does not push, and the closure
|
|
record says it is not cached.
|
|
|
|
The push token is not an option. It is at
|
|
`secret/swarm/services/attic/push-token` in the swarm secret store
|
|
(field `value`), and the builder reads it on every push. The swarm's own
|
|
cache creates it; for an external cache the operator writes it.
|
|
'';
|
|
};
|
|
|
|
cache = lib.mkOption {
|
|
# attic's own rule for a cache name; the builder checks the same at start.
|
|
type = lib.types.nullOr (lib.types.strMatching "^[A-Za-z0-9][A-Za-z0-9_+-]{0,49}$");
|
|
default = "swarm";
|
|
example = "grid";
|
|
description = ''
|
|
Name of the cache on {option}`services.hyperhive.swarm.attic.domain`
|
|
that the swarm builder pushes closures to, the swarm's own cache by
|
|
default. The push token must be allowed to
|
|
push to it. The name follows attic's rule: 1 to 50 letters,
|
|
digits, `-`, `_` or `+`, starting with a letter or digit.
|
|
'';
|
|
};
|
|
};
|
|
}
|