b8157cb08e
The publisher on the authelia host has been writing `secret/swarm/hives/<hive>/queue/agent` — the OIDC client secret agent containers present to the swarm queue, plus the client id it belongs to — and nothing read it. This is the reader: a oneshot `swarm-bao-queue-agent` that logs in with the host's certificate and lands the two fields as two files under `deploy.hive-controller.queue.agentCredentialDir`, the secret `0600` and the client id `0644`. Two files rather than one because that is the consumer's shape: `swarm_queue_client::QueueConfig::from_env` takes the secret as a path and the client id as a value, so the split here is what keeps the next slice from parsing anything. Same shape as the store's first reader, `glue-matrix-bao-token.nix` — a cert login that fails loudly under `Restart=on-failure` because every state it fails on is one a retry fixes, then reads that degrade quietly because no retry turns "no value there" into a value. Unlike the matrix token there is no local fallback and none is possible, so absent files mean this hive's agents do not connect, which is the ordinary state of a swarm before the publisher has run. Nothing consumes the files yet and this unit is ordered `Before=` nothing. The next slice bind-mounts them into agent containers through hive-c0re and adds the ordering edge along with them. Refs #3805
48 lines
1.5 KiB
Nix
48 lines
1.5 KiB
Nix
# The full hyperhive host stack, pulled together in one place — this
|
|
# is what the flake exports as `nixosModules.default` (wrapped with
|
|
# the package/source wiring; see flake.nix). One import covers
|
|
# everything; `services.hyperhive.enable = true` turns the stack on.
|
|
#
|
|
# The forge is mandatory — hive-c0re mirrors every agent's applied
|
|
# config repo into it and it's the canonical store for the meta flake
|
|
# + `internal/*` repos, so there's no enable toggle; it deploys with
|
|
# hyperhive itself. hive-matrix is opt-in (off by default). All
|
|
# subsystems rely on `services.hyperhive.domain`, which is required
|
|
# (asserted in hive-network.nix) whenever hyperhive is enabled.
|
|
{
|
|
imports = [
|
|
./hyperhive.nix
|
|
./deploy.nix
|
|
./local-defaults.nix
|
|
./hive-c0re
|
|
./hive-ci.nix
|
|
./hive-forge
|
|
./hive-gateway
|
|
./hive-matrix.nix
|
|
./hive-network.nix
|
|
./hive-priv.nix
|
|
./hive-tls.nix
|
|
./otel.nix
|
|
./glue-bao-tls.nix
|
|
./glue-controller-bao-identity.nix
|
|
./glue-matrix-bao-token.nix
|
|
./glue-queue-agent-credential.nix
|
|
./glue-secret-publisher-bao-identity.nix
|
|
./swarm-authelia.nix
|
|
./swarm-bao.nix
|
|
./swarm-ca.nix
|
|
./swarm-secret-publisher.nix
|
|
./swarm-nats.nix
|
|
./swarm-controller.nix
|
|
./swarm-grafana.nix
|
|
./swarm-otel.nix
|
|
./swarm-snapshot-store.nix
|
|
./swarm-ui.nix
|
|
./swarm-victorialogs.nix
|
|
./swarm-victoriametrics.nix
|
|
./swarm-wireguard.nix
|
|
./swarm.nix
|
|
./swarm-peers-removed.nix
|
|
./swarm-required-services.nix
|
|
];
|
|
}
|