mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
9c995ad114
* fix(test): restore in-package tests that reach unexported symbols admin_upgrade_test.go and units_invariants_test.go were moved to external test packages while, in parallel, validateUpgradeFlags and unitVersionRe grew references in those same files. Both sides merged cleanly and the result did not compile, which silenced the systemd unit guards entirely. Also regenerates units_gen.go, which had drifted from build/systemd: it was missing spinifex-firewall.service and carried a stale spinifex-daemon.service. The drift landed unnoticed because those guards were the tests that could not build. Note that `go generate ./...` does not regenerate this file. The directive lives in generate.go, which is //go:build ignore, so go generate never scans it; the generator has to be run directly from spinifex/systemd. * fix(systemd): bump the daemon unit version so the firewall path reaches hosts The nftables firewall work added `-/etc/spinifex/firewall` to the daemon unit's ReadWritePaths but left the version marker at 1. Reconcile replaces a unit only when the installed version is lower than the embedded one; same version with different content is treated as operator-modified and left alone. An upgraded host would therefore keep its old unit and the daemon would never be able to write peers.nft. Bump the daemon unit to version 2 and give the firewall unit a marker of its own — it had none, so it read as version 0. Pin both body hashes. * fix(systemd): make go generate actually regenerate units_gen.go The directive sat in generate.go, which is //go:build ignore, so go generate never scanned the file and never ran it. Every drift failure told the reader to run `go generate ./...`, which silently did nothing for this file, and the units_gen.go drift that hid the daemon unit version bug landed that way. Move the directive to reconcile.go, which is part of the package and is scanned, and drop the dead one.