d8e26a17bb
`services.hyperhive.gateway.enable`, `gateway.dns.enable` and `network.enable` replace the `hyperhive.enable` gate on all three. Each defaults to false; the modules that need one assert it with `mkDefault true` from inside the guard their own deployment already carries, and `swarm-required-services.nix` — the module that owns what the swarm-services toggle implies — asserts all three explicitly. hive-c0re asserts all three unconditionally, so an ordinary hive keeps getting them with no opt-in: it is the host's only knowledge that agent containers exist. The resolver moves to its own `hive-gateway/dns.nix` so it can be gated without reindenting the nginx half of the module. Reinstates `network.enable`, dropping its `mkRemovedOptionModule` shim. A config still carrying `network.enable = false` from before the removal now switches the bridge off instead of failing eval. Also deletes a duplicate `centralToggleOff` fixture in nix/module-eval.nix. Two sibling slices added it independently (c5f60fd5,ce3b3d94); the merge was textually clean and left `main` failing to evaluate at all, so this file could not be gated without removing one.
108 lines
5.1 KiB
Nix
108 lines
5.1 KiB
Nix
# "The swarm-wide services run HERE."
|
|
#
|
|
# A swarm has one forge, one matrix, one SSO. This says this host is
|
|
# where they live, and asserts the per-service `enable`s that follow —
|
|
# the same mode-not-default shape as ./local-defaults.nix, one tier down.
|
|
#
|
|
# Only the *optional* services derive. The forge has no `enable` to
|
|
# assert, because it is not optional — it is the canonical store for the
|
|
# meta flake and every agent's config repo, so it deploys with hyperhive
|
|
# itself.
|
|
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
deployCfg = config.services.hyperhive.deploy;
|
|
in
|
|
{
|
|
options.services.hyperhive.deploy.allSwarmServices = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
example = true;
|
|
description = ''
|
|
Host the swarm's shared services on this hive. The services that
|
|
exist once per swarm rather than once per hive and are *optional*
|
|
— the matrix homeserver, the SSO provider, the queue, the metrics
|
|
and log stores — have their toggle asserted from this, so a
|
|
swarm's service host is declared in one place.
|
|
|
|
Every toggle it asserts is a {option}`services.hyperhive.deploy.*`
|
|
one, because "does THIS host run it" is a per-host decision — which
|
|
is the same reason this option is a `deploy.*` one itself. See
|
|
./deploy.nix.
|
|
|
|
The forge is swarm-wide too but has nothing to assert: it is the
|
|
canonical store for the meta flake and every agent's config repo,
|
|
so it deploys with hyperhive itself and is not optional.
|
|
|
|
`services.hyperhive.deploy.singleHostSwarm` turns this on as part
|
|
of the all-on-one-box mode. Set it directly to run the swarm's
|
|
services on a host that is not otherwise all-local — a dedicated
|
|
services box with hives elsewhere is exactly that shape.
|
|
|
|
With it off, this hive is a *client* of those services: it still
|
|
configures how to reach them, it just doesn't run them.
|
|
'';
|
|
};
|
|
|
|
# Same precedence reasoning as ./local-defaults.nix: fills in for an
|
|
# operator who hasn't spoken, yields to one who has.
|
|
#
|
|
# Everything derives under `deploy.*` now, because "does THIS host run
|
|
# it" is a per-host decision and `swarm.*` has to be identical on every
|
|
# host. Same switch, same rule, one attribute path.
|
|
config.services.hyperhive.deploy.matrix.enable = lib.mkDefault deployCfg.allSwarmServices;
|
|
|
|
# The collector that feeds the pair above (note: no `swarm.` prefix,
|
|
# this is ./otel.nix's existing per-hive option).
|
|
config.services.hyperhive.otel.enable = lib.mkDefault deployCfg.allSwarmServices;
|
|
|
|
# The rest of the shared services, from the same switch and for the same
|
|
# reason.
|
|
#
|
|
# authelia: a swarm has one SSO provider, and this says it lives here.
|
|
# With it off the hive is a *client* — `swarm.authelia.url` still points
|
|
# at whoever runs it.
|
|
config.services.hyperhive.deploy.authelia.enable = lib.mkDefault deployCfg.allSwarmServices;
|
|
|
|
# The queue. Same rule: once per swarm, optional.
|
|
config.services.hyperhive.deploy.nats.enable = lib.mkDefault deployCfg.allSwarmServices;
|
|
|
|
# The swarm collector that feeds the metrics pair, and the only tier
|
|
# holding the upstream credential. ⚠️ NOT the per-hive collector below,
|
|
# which every hive runs.
|
|
config.services.hyperhive.deploy.swarm-otel.enable = lib.mkDefault deployCfg.allSwarmServices;
|
|
|
|
# The metrics pair, deriving together on purpose: a store with no UI is
|
|
# unreadable and a UI with no store is empty, so there is no sensible
|
|
# deployment that takes one and not the other from this switch. An
|
|
# operator who wants exactly one still sets it directly, which
|
|
# `mkDefault` allows.
|
|
config.services.hyperhive.deploy.victoriametrics.enable = lib.mkDefault deployCfg.allSwarmServices;
|
|
config.services.hyperhive.deploy.grafana.enable = lib.mkDefault deployCfg.allSwarmServices;
|
|
|
|
# The log store, from the same switch for the same reason as the rest: a
|
|
# hive that is not the service host is a *client* of it, not a second one.
|
|
config.services.hyperhive.deploy.victorialogs.enable = lib.mkDefault deployCfg.allSwarmServices;
|
|
|
|
# The plumbing those services are reached over: every one of them is
|
|
# fronted by the gateway, resolved through the hive's dnsmasq, and runs
|
|
# in a container hanging off the bridge. Written as `mkIf … mkDefault`
|
|
# rather than `mkDefault allSwarmServices` because the modules that need
|
|
# these also assert them — a `false` from here would collide with their
|
|
# `true` instead of losing to it.
|
|
config.services.hyperhive.gateway.enable = lib.mkIf deployCfg.allSwarmServices (lib.mkDefault true);
|
|
config.services.hyperhive.gateway.dns.enable = lib.mkIf deployCfg.allSwarmServices (
|
|
lib.mkDefault true
|
|
);
|
|
config.services.hyperhive.network.enable = lib.mkIf deployCfg.allSwarmServices (lib.mkDefault true);
|
|
|
|
# The secret store. Once per swarm and optional, so it belongs to the
|
|
# same switch: a hive that does not run it is a *client*, reading its
|
|
# own secrets from whoever does. `mkDefault` is what keeps the store
|
|
# placeable on a host of its own — it can be set directly here and
|
|
# turned off wherever this switch happens to be on.
|
|
config.services.hyperhive.deploy.bao.enable = lib.mkDefault deployCfg.allSwarmServices;
|
|
}
|