433b294099
One attrset describing every hive in the swarm including this one,
identical on every host, with hiveName selecting which entry is us.
"My peers" is derived (swarm.peerHives) rather than declared.
Every field in the old per-host peer list was intrinsic to the hive it
described, never to the pair -- so the list was a directory each host
kept its own copy of. Beyond the deduplication it removes a bug class:
two hosts could hold different endpoints for the same third hive with
nothing to detect the disagreement.
Drops the per-hive caCert. Trust inside a swarm derives from the swarm
root, which every hive chains to. What that genuinely removes is
trusting a hive whose root this swarm does not own -- a cross-swarm
problem that wants a mechanism of its own, not a field that happened to
work.
The matrix container's certificateFiles block goes with it and could
NOT be migrated: that list is read at build time and the swarm root is
a runtime file (its key must never enter the store), so there is no
build-time name to put there. caCert being a nix path was precisely
what made it the build-time distribution channel. Agents are unaffected
-- hive-tls folds the root into the hive trust bundle and the meta
renderer embeds that one file. Tracked separately.
Migration is an assertion plus warnings, not a rename: hives is peers
union {self}, and the set gains a member no existing config has written
down. A rename migrates a name and a default can re-root a meaning;
neither can conjure a new member. The warning explains, the self-entry
assertion stops the build.
70 lines
2.9 KiB
Nix
70 lines
2.9 KiB
Nix
# Migration shim for `services.hyperhive.swarm.peers`, replaced by the
|
||
# `swarm.hives` directory in ./swarm.nix.
|
||
#
|
||
# ⚠️ This could not be a `mkRenamedOptionModule`. `hives` is not `peers`
|
||
# under a new name, it is **`peers` ∪ {self}**: the set gains a member no
|
||
# existing config has ever written down, because a host's own identity
|
||
# lived in *other* options entirely. A rename migrates a name and a
|
||
# default can re-root a meaning; neither can conjure a new member.
|
||
#
|
||
# The whole module is self-contained and deletable — one file to remove
|
||
# when the deprecation window closes, with nothing else referring to it.
|
||
#
|
||
# Deliberately a warning rather than a hard failure, with the loudness
|
||
# coming from elsewhere: a config that set only `peers` leaves `hives`
|
||
# empty, so the self-entry assertion in ./swarm.nix fails the build
|
||
# anyway. The warning is what explains it; the assertion is what stops
|
||
# it.
|
||
{
|
||
lib,
|
||
config,
|
||
...
|
||
}:
|
||
let
|
||
peers = config.services.hyperhive.swarm.peers;
|
||
withCaCert = lib.attrNames (lib.filterAttrs (_: p: p ? caCert && p.caCert != null) peers);
|
||
in
|
||
{
|
||
options.services.hyperhive.swarm.peers = lib.mkOption {
|
||
type = lib.types.attrsOf lib.types.anything;
|
||
default = { };
|
||
visible = false;
|
||
internal = true;
|
||
description = ''
|
||
Removed — use `services.hyperhive.swarm.hives` instead, which
|
||
describes every hive in the swarm including this one. Kept only so
|
||
an existing definition produces a warning that says where to move
|
||
it, rather than an "option does not exist" error that says nothing.
|
||
'';
|
||
};
|
||
|
||
config.warnings =
|
||
lib.optional (peers != { }) ''
|
||
services.hyperhive.swarm.peers is removed and ignored. Move these
|
||
entries to services.hyperhive.swarm.hives, keyed by hive NAME
|
||
rather than domain, and add an entry for this hive itself
|
||
(services.hyperhive.hiveName) — `hives` is the swarm's full
|
||
directory, identical on every host.
|
||
|
||
services.hyperhive.swarm.hives.<name> = {
|
||
domain = "<the old attrset key>";
|
||
# certFingerprint / wireguard* carry over unchanged
|
||
};
|
||
|
||
Still set: ${lib.concatStringsSep ", " (lib.attrNames peers)}
|
||
''
|
||
++ lib.optional (withCaCert != [ ]) ''
|
||
services.hyperhive.swarm.peers.<hive>.caCert is removed and
|
||
ignored, and has no replacement in services.hyperhive.swarm.hives.
|
||
|
||
Trust inside a swarm now derives from the swarm root CA
|
||
(services.hyperhive.swarm.ca — see docs/swarm/ca.md): every hive
|
||
under it chains to it, so a per-hive CA is dead weight. What this
|
||
genuinely drops is trusting a hive whose root this swarm does NOT
|
||
own — another swarm's, or one keeping its own CA. certFingerprint
|
||
does not cover that: it pins a leaf for hive-c0re's own HTTPS
|
||
checks and does not reach Matrix federation.
|
||
|
||
Still set on: ${lib.concatStringsSep ", " withCaCert}
|
||
'';
|
||
}
|