public: document that a Caddyfile change reloads caddy (verification for nix-config#926) #1963

Merged
hermes merged 1 commit from kb/NCFG-926-caddyfile-reload-probe into main 2026-10-13 05:58:15 -06:00
Collaborator

Part of card nix-config#926. This is the config-CONTENT-only deploy that proves the fix.

nix-config#926 (PR #1960) set services.caddy.enableReload = true on public, mail
and vpn, so the nixpkgs caddy module keeps the rendered Caddyfile in
reloadTriggers and adds ExecReload = caddy reload --config ... --force.

The switch that MAKES that move also changes the unit definition, so it still
restarts caddy once (the transition is unavoidable). The DoD's "a deploy that
changes the Caddyfile reloads rather than restarts" therefore needs a second
deploy whose ONLY change is the Caddyfile content - this one.

The added comment is real content of the config and is what the reviewer of this
behaviour needs to know. Evidence on the merge deploy:

  • public: caddy MainPID unchanged and ActiveEnterTimestamp unchanged across
    the deploy (a restart would change both);
  • systemctl journal shows Reloading caddy.service ... / Reloaded, with no
    Stopping Caddy / Started Caddy pair;
  • the rendered Caddyfile store path changes (the X-Reload-Triggers content with
    it);
  • an external probe of a vhost plus ymrtech.com/account across the deploy shows
    zero failed samples.
Part of card nix-config#926. This is the config-CONTENT-only deploy that proves the fix. nix-config#926 (PR #1960) set services.caddy.enableReload = true on public, mail and vpn, so the nixpkgs caddy module keeps the rendered Caddyfile in `reloadTriggers` and adds `ExecReload = caddy reload --config ... --force`. The switch that MAKES that move also changes the unit definition, so it still restarts caddy once (the transition is unavoidable). The DoD's "a deploy that changes the Caddyfile reloads rather than restarts" therefore needs a second deploy whose ONLY change is the Caddyfile content - this one. The added comment is real content of the config and is what the reviewer of this behaviour needs to know. Evidence on the merge deploy: - public: caddy MainPID unchanged and `ActiveEnterTimestamp` unchanged across the deploy (a restart would change both); - `systemctl` journal shows `Reloading caddy.service ...` / `Reloaded`, with no `Stopping Caddy` / `Started Caddy` pair; - the rendered Caddyfile store path changes (the X-Reload-Triggers content with it); - an external probe of a vhost plus ymrtech.com/account across the deploy shows zero failed samples.
public: document that a Caddyfile change reloads caddy (verification vehicle for nix-config#926)
All checks were successful
PR base guard / Base drift / conflict check (pull_request) Successful in 6s
NixOS Build Check / Flake input regression guard (pull_request) Successful in 5s
Secret Scan / gitleaks scan (pull_request) Successful in 11s
NixOS Build Check / Scope changed deployable hosts (pull_request) Successful in 35s
NixOS Build Check / Hermes runtime gates (one eval of vpn's runtime) (pull_request) Has been skipped
NixOS Build Check / Worker-scope reaper worker signature (mutation-tested) (pull_request) Successful in 4s
NixOS Build Check / Kanban pool capacity knob (runtime override + clamp, mutation-tested) (pull_request) Successful in 3s
NixOS Build Check / Sentinel pass budget contract (prompt forbids the full board walk, mutation-tested) (pull_request) Successful in 3s
NixOS Build Check / CI-scratch reaper class table (mutation-tested) (pull_request) Successful in 4s
NixOS Build Check / foremerge accept-order contract (real binary) (pull_request) Has been skipped
foremerge intent (advisory) all 1 changed path(s) covered by a live foremerge intent
NixOS Build Check / .forgejo/tests python suites (hermetic) (pull_request) Successful in 39s
NixOS Build Check / Build changed host closures (native, one eval) (pull_request) Successful in 2m8s
NixOS Build Check / Repo gates (the folded selftest battery) (pull_request) Successful in 4m23s
127a679dca
Config-content-only change on public. Its job is to be the second deploy that
proves the enableReload fix from nix-config#926: the rendered Caddyfile changes,
`X-Reload-Triggers` changes with it, and `switch-to-configuration` must reload
caddy rather than restart it (no Stopping/Started pair, same MainPID).
hermes force-pushed kb/NCFG-926-caddyfile-reload-probe from 127a679dca
All checks were successful
PR base guard / Base drift / conflict check (pull_request) Successful in 6s
NixOS Build Check / Flake input regression guard (pull_request) Successful in 5s
Secret Scan / gitleaks scan (pull_request) Successful in 11s
NixOS Build Check / Scope changed deployable hosts (pull_request) Successful in 35s
NixOS Build Check / Hermes runtime gates (one eval of vpn's runtime) (pull_request) Has been skipped
NixOS Build Check / Worker-scope reaper worker signature (mutation-tested) (pull_request) Successful in 4s
NixOS Build Check / Kanban pool capacity knob (runtime override + clamp, mutation-tested) (pull_request) Successful in 3s
NixOS Build Check / Sentinel pass budget contract (prompt forbids the full board walk, mutation-tested) (pull_request) Successful in 3s
NixOS Build Check / CI-scratch reaper class table (mutation-tested) (pull_request) Successful in 4s
NixOS Build Check / foremerge accept-order contract (real binary) (pull_request) Has been skipped
foremerge intent (advisory) all 1 changed path(s) covered by a live foremerge intent
NixOS Build Check / .forgejo/tests python suites (hermetic) (pull_request) Successful in 39s
NixOS Build Check / Build changed host closures (native, one eval) (pull_request) Successful in 2m8s
NixOS Build Check / Repo gates (the folded selftest battery) (pull_request) Successful in 4m23s
to 2b21bf0543
All checks were successful
NixOS Build Check / Flake input regression guard (pull_request) Successful in 6s
PR base guard / Base drift / conflict check (pull_request) Successful in 4s
NixOS Build Check / Scope changed deployable hosts (pull_request) Successful in 9s
NixOS Build Check / Hermes runtime gates (one eval of vpn's runtime) (pull_request) Has been skipped
NixOS Build Check / Worker-scope reaper worker signature (mutation-tested) (pull_request) Successful in 4s
Secret Scan / gitleaks scan (pull_request) Successful in 11s
NixOS Build Check / Kanban pool capacity knob (runtime override + clamp, mutation-tested) (pull_request) Successful in 2s
NixOS Build Check / Sentinel pass budget contract (prompt forbids the full board walk, mutation-tested) (pull_request) Successful in 2s
NixOS Build Check / CI-scratch reaper class table (mutation-tested) (pull_request) Successful in 2s
NixOS Build Check / foremerge accept-order contract (real binary) (pull_request) Has been skipped
foremerge intent (advisory) all 1 changed path(s) covered by a live foremerge intent
NixOS Build Check / .forgejo/tests python suites (hermetic) (pull_request) Successful in 37s
NixOS Build Check / Build changed host closures (native, one eval) (pull_request) Successful in 1m11s
NixOS Build Check / Repo gates (the folded selftest battery) (pull_request) Successful in 2m53s
2026-10-13 05:54:49 -06:00
Compare
hermes merged commit 3a40d97822 into main 2026-10-13 05:58:15 -06:00
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
ymrtech/nix-config!1963
No description provided.