b422367942
`services.hyperhive.swarm.*` is meant to be identical on every host in a swarm — it describes the swarm, and every hive needs all of it to be a client. But it also carried the `enable` toggles, which are precisely the values that must differ per machine. The namespace that should be the same everywhere held the one thing that cannot be. Adds `services.hyperhive.deploy.*` for a host's deployment decisions, and moves the first of them (`swarm.grafana.enable` -> `deploy.grafana`) as the pattern for the rest. Flat and named for the thing deployed rather than grouped under a "swarm services" attribute: from the deploy side it does not matter what kind of thing each one is, and a grouping by service kind would re-encode the service-side taxonomy into a layer that does not care about it. Behaviour is unchanged. The move is a rename in the strict sense — same type, same meaning, new path — so `mkRenamedOptionModule` carries it and existing configs keep evaluating with one warning naming both paths. The renames live in the new module rather than the service modules, so the whole migration has a single home and a single file to delete when the deprecation window closes.
98 lines
4.7 KiB
Nix
98 lines
4.7 KiB
Nix
# "The swarm-wide services run HERE."
|
|
#
|
|
# A swarm has one forge, one matrix, one SSO. This says this host is
|
|
# where they live, and asserts the per-service `enable`s that follow —
|
|
# the same mode-not-default shape as ./local-defaults.nix, one tier down.
|
|
#
|
|
# Only the *optional* services derive: matrix and authelia. The forge has
|
|
# no `enable` to assert, because it is not optional — it is the canonical
|
|
# store for the meta flake and every agent's config repo, so it deploys
|
|
# with hyperhive itself.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
swarmCfg = config.services.hyperhive.swarm;
|
|
in
|
|
{
|
|
options.services.hyperhive.swarm.enableRequiredServices = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
example = true;
|
|
description = ''
|
|
Host the swarm's shared services on this hive. The services that
|
|
exist once per swarm rather than once per hive and are *optional*
|
|
— the matrix homeserver, the SSO provider — have their `enable`
|
|
asserted from this, so a swarm's service host is declared in one
|
|
place.
|
|
|
|
The forge is swarm-wide too but has nothing to assert: it is the
|
|
canonical store for the meta flake and every agent's config repo,
|
|
so it deploys with hyperhive itself and is not optional.
|
|
|
|
`services.hyperhive.enableAllLocalDefaults` turns this on as part
|
|
of the all-on-one-box mode. Set it directly to run the swarm's
|
|
services on a host that is not otherwise all-local — a dedicated
|
|
services box with hives elsewhere is exactly that shape.
|
|
|
|
With it off, this hive is a *client* of those services: it still
|
|
configures how to reach them, it just doesn't run them.
|
|
'';
|
|
};
|
|
|
|
# Same precedence reasoning as ./local-defaults.nix: fills in for an
|
|
# operator who hasn't spoken, yields to one who has.
|
|
config.services.hyperhive.swarm = {
|
|
matrix.enable = lib.mkDefault swarmCfg.enableRequiredServices;
|
|
authelia.enable = lib.mkDefault swarmCfg.enableRequiredServices;
|
|
# The queue. Added later than the two above and missed at the time —
|
|
# this file predates the `swarm-nats` container by nine days and had
|
|
# not been revisited since, so its absence was sequence rather than
|
|
# intent. It meets the rule in the option's own description exactly:
|
|
# once per swarm, and optional.
|
|
#
|
|
# The tell that it was an omission: `local-defaults.nix` already
|
|
# derives `nats.autoGenerateCallout` from the all-local mode, so that
|
|
# mode was minting the queue's callout nkeys and then never starting
|
|
# the queue they authenticate against.
|
|
nats.enable = lib.mkDefault swarmCfg.enableRequiredServices;
|
|
|
|
# The metrics pair. Once per swarm and optional, so they meet the rule
|
|
# in the option's description the same way the three above do — a hive
|
|
# that is not the service host is a *client* of this Grafana, not a
|
|
# second one.
|
|
#
|
|
# They derive together on purpose: a store with no UI is unreadable and
|
|
# a UI with no store is empty, so there is no sensible deployment that
|
|
# takes one and not the other from this switch. An operator who wants
|
|
# exactly one still sets it directly, which `mkDefault` allows.
|
|
victoriametrics.enable = lib.mkDefault swarmCfg.enableRequiredServices;
|
|
# (grafana's half of the pair derives below — it lives in `deploy.*`
|
|
# now, which is a different attribute path, not a different rule.)
|
|
|
|
# The log store, deriving from the same switch for the same reason —
|
|
# and deliberately in the same commit as the collector pipeline that
|
|
# writes to it, never before it. A store nothing writes to is worse
|
|
# than no store: it starts, answers queries, and returns nothing, so
|
|
# the first person to look concludes there were no logs.
|
|
victorialogs.enable = lib.mkDefault swarmCfg.enableRequiredServices;
|
|
|
|
# The collector that feeds the pair above, and the only tier holding
|
|
# the upstream credential. Same rule as the rest: once per swarm,
|
|
# optional, and a hive that is not the service host is a *client* of
|
|
# it (by name, `swarm.otel.domain`) rather than a second one.
|
|
otel.enable = lib.mkDefault swarmCfg.enableRequiredServices;
|
|
};
|
|
|
|
# The collector that feeds the pair above (note: no `swarm.` prefix,
|
|
# this is ./otel.nix's existing per-hive option).
|
|
config.services.hyperhive.otel.enable = lib.mkDefault swarmCfg.enableRequiredServices;
|
|
|
|
# Grafana, the UI half of the metrics pair. Same derivation and the same
|
|
# reasoning as `victoriametrics.enable` above; it reads differently only
|
|
# because "does this host run it" now lives in `deploy.*` (./deploy.nix)
|
|
# rather than under `swarm.*`, which has to be identical on every host.
|
|
config.services.hyperhive.deploy.grafana = lib.mkDefault swarmCfg.enableRequiredServices;
|
|
}
|