124 lines
4.1 KiB
Nix
124 lines
4.1 KiB
Nix
# The fixtures more than one `checks.module-eval-*` cluster reads, each
|
|
# evaluated once. ../checks.nix imports this file once and hands the result to
|
|
# every cluster that uses one; a cluster rebinds the fixture under its own
|
|
# local name.
|
|
#
|
|
# ⚠️ Sharing only pays when ../checks.nix instantiates this file ONCE: a
|
|
# cluster that ran `import ./shared.nix` itself would get its own copy of
|
|
# every fixture, the same as defining them locally. The cost is that each
|
|
# fixture here stays live for the whole evaluation rather than one cluster's.
|
|
#
|
|
# Holds only configs that are identical across their users. A cluster whose
|
|
# claim needs one more option set defines its own fixture.
|
|
{
|
|
pkgs,
|
|
lib,
|
|
self,
|
|
nixosSystem,
|
|
}:
|
|
let
|
|
inherit
|
|
(import ./lib.nix {
|
|
inherit
|
|
pkgs
|
|
lib
|
|
self
|
|
nixosSystem
|
|
;
|
|
})
|
|
hive
|
|
hiveWithController
|
|
agent
|
|
agentWith
|
|
;
|
|
|
|
# The four auth responder packages pinned to four distinct derivations, so
|
|
# a unit's ExecStart names which option it read. Nothing else reads them.
|
|
marker = name: pkgs.runCommand "auth-marker-${name}" { } "mkdir $out";
|
|
in
|
|
{
|
|
agentBare = agent { };
|
|
|
|
agentWithBao = agentWith { services.hyperhive.agent.bao.addr = "https://bao.t.local:8200"; };
|
|
|
|
bare = hive { };
|
|
|
|
bareWithController = hiveWithController { };
|
|
|
|
allLocal = hiveWithController {
|
|
deploy.singleHostSwarm = true;
|
|
deploy.victorialogs.authPackage = marker "logs";
|
|
deploy.victorialogs.grafanaAuthPackage = marker "logs-grafana";
|
|
deploy.victoriametrics.authPackage = marker "metrics";
|
|
deploy.victoriametrics.agentAuthPackage = marker "metrics-agent";
|
|
};
|
|
|
|
autheliaOnly = hive { deploy.authelia.enable = true; };
|
|
|
|
forgeHere = hive { deploy.forgejo.enable = true; };
|
|
|
|
baoOnly = hive { deploy.bao.enable = true; };
|
|
|
|
servicesHere = hive { deploy.allSwarmServices = true; };
|
|
|
|
# The all-swarm-services switch on the controller's host, the services box
|
|
# shape that hives elsewhere join.
|
|
swarmServicesWithController = hiveWithController { deploy.allSwarmServices = true; };
|
|
|
|
# The queue with no store identity.
|
|
natsQueueOnly = hive {
|
|
deploy.nats.enable = true;
|
|
deploy.nats.authPackage = pkgs.emptyDirectory;
|
|
};
|
|
|
|
# The queue on the store's host with the hive's own reader pointed
|
|
# somewhere else.
|
|
natsOnStoreHostReaderMoved = hive {
|
|
deploy.bao.enable = true;
|
|
deploy.nats.enable = true;
|
|
deploy.bao.clientCertFile = "/etc/pki/h1.pem";
|
|
deploy.bao.clientKeyFile = "/etc/pki/h1-key.pem";
|
|
};
|
|
|
|
controllerAlone = hive { deploy.swarm-controller.enable = true; };
|
|
|
|
matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };
|
|
|
|
baoWithMatrix = hiveWithController {
|
|
deploy.bao.enable = true;
|
|
deploy.matrix.enable = true;
|
|
};
|
|
|
|
# A second job declared as bare `host:port`, so a case can read one rendered
|
|
# scrape list where the store's entry carries a path and this one carries
|
|
# none.
|
|
baoWithCollector = hive {
|
|
deploy.bao.enable = true;
|
|
deploy.swarm-otel.enable = true;
|
|
swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
|
|
};
|
|
|
|
# `clientSecretFile` is what ../host-modules/otel.nix's identity assertion
|
|
# demands of any host running a hive.
|
|
baoWithHiveOtel = hiveWithController {
|
|
deploy.bao.enable = true;
|
|
otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
|
|
};
|
|
|
|
# The swarm collector with the IdP on another host and the store leaf placed
|
|
# by hand, without and with the collector's own OIDC pair.
|
|
otelReaderMissingLeaf = hive {
|
|
deploy.swarm-otel.enable = true;
|
|
swarm.authelia.url = "https://auth.example.invalid";
|
|
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
|
|
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
|
|
};
|
|
otelReaderNamedInFull = hive {
|
|
deploy.swarm-otel.enable = true;
|
|
swarm.authelia.url = "https://auth.example.invalid";
|
|
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
|
|
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
|
|
deploy.bao.otelOidcClientCertFile = "/etc/pki/bao-otel-oidc.pem";
|
|
deploy.bao.otelOidcClientKeyFile = "/etc/pki/bao-otel-oidc-key.pem";
|
|
};
|
|
}
|