3202cde704
`services.hyperhive.enable` and `services.hyperhive.c0re.enable` are gone. One switch, `services.hyperhive.deploy.hive-controller.enable` (default false, as the old toggle was), now gates hive-c0re and hive-priv. Both old paths are `mkRenamedOptionModule` shims in deploy.nix, so a host config that still sets either evaluates as before and gets a rename warning. Every other read of the old toggle is resolved, including the 29 made through the `hyperhiveCfg`/`hiveCfg` aliases: - Dropped: each swarm service and its glue keeps only its own deploy toggle (authelia, bao and its PKI glue, grafana, victorialogs, victoriametrics, the secret publisher, swarm-ca, the OIDC client rows, the controller/nats/matrix-ctl/publisher/services-issuer identities), the forge, and the `domain` deprecation warning. - To deploy.hive-controller.enable: the queue-agent credential reader and its assertion, which feed hive-c0re and write under its state dir, plus their policy-order entry; the network identity assertions; hive-tls's two writes into hive-c0re's environment. - hive-tls runs where the gateway runs self-signed (`gateway.enable && useSelfSigned`), not on every host. - The matrix appservice-token reader and its assertion stay on `deploy.matrix.enable` plus their client-identity checks. They read deploy.matrix's token file and registration script; their deploy.bao inputs are the client-half options a hive sets to read a store it does not run, so gating on deploy.bao.enable would drop the tested remote-reader case. - The `hiveName` assertion moves from hive-network.nix to hyperhive.nix and fires wherever the hive, the store or the homeserver runs: each turns the name into an identifier with no fallback. On a host with `deploy.allSwarmServices` and no hive, the documented services-host recipe, authelia, bao, grafana, victorialogs, victoriametrics, the OIDC client rows and the hive CA now render; before, the old toggle being off left them out. Refs #4500
58 lines
1.9 KiB
Nix
58 lines
1.9 KiB
Nix
# The full hyperhive host stack, pulled together in one place — this
|
|
# is what the flake exports as `nixosModules.default` (wrapped with
|
|
# the package/source wiring; see flake.nix). One import covers
|
|
# everything; `services.hyperhive.deploy.hive-controller.enable = true`
|
|
# runs a hive on this host.
|
|
#
|
|
# Every swarm needs the forge — hive-c0re mirrors every agent's applied
|
|
# config repo into it and it's the canonical store for the meta flake
|
|
# + `internal/*` repos — but only the host with `deploy.forgejo.enable`
|
|
# runs it (derived from `deploy.allSwarmServices`, see
|
|
# ./swarm-required-services.nix). hive-matrix is opt-in (off by default). All
|
|
# subsystems rely on `services.hyperhive.domain`, which is required
|
|
# (asserted in hive-network.nix) wherever this host runs a hive.
|
|
{
|
|
imports = [
|
|
./hyperhive.nix
|
|
./deploy.nix
|
|
./local-defaults.nix
|
|
./hive-c0re
|
|
./hive-ci.nix
|
|
./hive-forge
|
|
./hive-gateway
|
|
./hive-matrix.nix
|
|
./hive-network.nix
|
|
./hive-priv.nix
|
|
./hive-tls.nix
|
|
./otel.nix
|
|
./glue-bao-readers-policy-order.nix
|
|
./glue-bao-tls.nix
|
|
./glue-controller-bao-identity.nix
|
|
./glue-forge-oidc-client.nix
|
|
./glue-grafana-oidc-client.nix
|
|
./glue-matrix-bao-token.nix
|
|
./glue-matrix-ctl-bao-identity.nix
|
|
./glue-nats-bao-identity.nix
|
|
./glue-queue-agent-credential.nix
|
|
./glue-secret-publisher-bao-identity.nix
|
|
./glue-services-issuer-bao-identity.nix
|
|
./glue-swarm-bao-otel-oidc-client.nix
|
|
./glue-swarm-otel-oidc-client.nix
|
|
./swarm-authelia.nix
|
|
./swarm-bao.nix
|
|
./swarm-ca.nix
|
|
./swarm-secret-publisher.nix
|
|
./swarm-nats.nix
|
|
./swarm-controller.nix
|
|
./swarm-grafana.nix
|
|
./swarm-otel.nix
|
|
./swarm-snapshot-store.nix
|
|
./swarm-ui.nix
|
|
./swarm-victorialogs.nix
|
|
./swarm-victoriametrics.nix
|
|
./swarm-wireguard.nix
|
|
./swarm.nix
|
|
./swarm-peers-removed.nix
|
|
./swarm-required-services.nix
|
|
];
|
|
}
|