feat(grpc): always-on server, remove the enable toggle

The gRPC interface is a core API, not an add-on, and an idle listener costs
next to nothing -- so it should not be disablable. Drop config :hyper,
Hyper.Grpc, :enabled and start the server unconditionally on every node.
Config now only tunes the listener (port default 50051, TLS, adapter opts).
Document the co-located-nodes caveat (each node binds :port).

Author: markovejnovic

README.md

@@ -63,8 +63,8 @@ cluster. The contract lives at `proto/hyper/grpc/v0/hyper.proto`
 > **v0:** unstable — the contract may change without notice during early
 > development.
 
-The server is opt-in and configured entirely from your own `config/`; it is
-stateless and may run on every node. See
+The server always runs on every node and is configured (port, TLS) entirely
+from your own `config/`; it is stateless. See
 [the gRPC guide](docs/grpc.md) for configuration, TLS, connecting from any
 language, and regenerating the bindings.
 

config/config.exs

@@ -43,8 +43,6 @@ config :hyper, Hyper.Img.Db.Repo,
   hostname: "localhost",
   pool_size: 10
 
-# The public gRPC interface is opt-in and off by default. Operators enable and
-# configure it from their own config (port, TLS, adapter opts) -- see
-# `Hyper.Grpc.Config`. Everything but `:enabled` is passed through to
-# `GRPC.Server.Supervisor`.
-config :hyper, Hyper.Grpc, enabled: false
+# The public gRPC interface always runs (it is a core interface, not opt-in).
+# Tune the listener -- port, TLS, adapter opts -- from your own config; see
+# `Hyper.Grpc.Config`. With no config it serves plaintext on port 50051.

docs/grpc.md

@@ -24,36 +24,20 @@ A machine is addressed by its **`vm_id`** — a URL-safe base64 string the serve
 mints at creation. The server is stateless and identical on every node;
 placement and routing are cluster-wide, so any node can serve any request.
 
-### Optional fields
-
-`CreateMachineRequest` uses proto3 `optional` (explicit field presence) instead
-of magic sentinel enum values. An **unset** field is absent on the wire (and
-`nil` in Elixir), and the server applies its default:
-
-| Field           | Type           | Unset means                          |
-| --------------- | -------------- | ------------------------------------ |
-| `img_id`        | `string`       | required                             |
-| `instance_type` | `InstanceType` | `INSTANCE_TYPE_BASE`                 |
-| `arch`          | `Architecture` | resolve to the scheduling node's arch|
-| `boot_args`     | `string`       | the standard serial-console cmdline  |
-
-There is no `*_UNSPECIFIED` member: leave the field out to get the default.
-
 ## Configuring the server
 
-The server is **off by default**. Enable and configure it from your own
-application config under `config :hyper, Hyper.Grpc`. Only `:enabled` is special
-— every other key is passed straight through to
+The server **always runs** — it is a core interface, not an opt-in add-on, and
+an idle listener costs next to nothing. With no config it serves plaintext on
+port `50051`. Tune the listener from your own application config under
+`config :hyper, Hyper.Grpc`; every key is passed straight through to
 [`GRPC.Server.Supervisor`](https://hexdocs.pm/grpc_server/GRPC.Server.Supervisor.html),
-so you control the listener entirely (`Hyper.Grpc.Config` documents this).
+so you control it entirely (`Hyper.Grpc.Config` documents this).
 
 ### Plaintext (development)
 
 ```elixir
 # config/dev.exs
-config :hyper, Hyper.Grpc,
-  enabled: true,
-  port: 50_051
+config :hyper, Hyper.Grpc, port: 50_051
 ```
 
 `:port` defaults to `50051` if omitted.
@@ -67,7 +51,6 @@ paths are read at boot, not compile time:
 # config/runtime.exs
 if config_env() == :prod do
   config :hyper, Hyper.Grpc,
-    enabled: true,
     port: 50_051,
     cred:
       GRPC.Credential.new(
@@ -85,9 +68,10 @@ supervisor option works too (`adapter_opts:`, `max_body_size:`, …).
 
 ### How it starts
 
-`Hyper.Application` splices `Hyper.Grpc.server_children/0` into its supervision
-tree. That returns `[]` when `enabled: false`, so a default build starts no
-server. Run the server on as many nodes as you like.
+`Hyper.Application` unconditionally splices `Hyper.Grpc.server_children/0` into
+its supervision tree on every node. Because each node binds `:port`, running
+several nodes on one host (e.g. a local cluster) means giving each its own port
+in config.
 
 ## Connecting
 
@@ -124,21 +108,3 @@ adapter):
     %Hyper.Grpc.V0.StopMachineRequest{vm_id: vm_id}
   )
 ```
-
-## Regenerating the bindings
-
-The Elixir bindings (`lib/hyper/grpc/v0/hyper.pb.ex`) are **not committed** —
-they are generated from the `.proto` by the `:grpc_gen` Mix compiler before the
-Elixir compiler runs, the same way the Firecracker bindings are. Editing the
-`.proto` and recompiling is enough; to force a regen run `mix grpc.gen`.
-
-This requires `protoc` and the `protoc-gen-elixir` plugin in any environment
-that compiles Hyper from a fresh tree:
-
-```sh
-sudo apt-get install -y protobuf-compiler   # or: brew install protobuf
-mix escript.install hex protobuf 0.17.0     # provides protoc-gen-elixir
-```
-
-The plugin escript installs to `~/.mix/escripts`, which the compiler prepends to
-`PATH` automatically.

lib/hyper/grpc.ex

@@ -15,10 +15,11 @@ defmodule Hyper.Grpc do
 
   ## Serving
 
-  The server is started by `Hyper.Application` when enabled in config. It is
-  stateless and may run on every node; placement and routing are cluster-wide.
-  See `Hyper.Grpc.Config` for configuration — operators own the listener (port,
-  TLS, adapter options) entirely from their own `config/`.
+  The server is always started by `Hyper.Application` — it is a core interface,
+  not an add-on, and an idle listener costs next to nothing. It is stateless and
+  runs on every node; placement and routing are cluster-wide. See
+  `Hyper.Grpc.Config` for configuration — operators own the listener (port, TLS,
+  adapter options) entirely from their own `config/`.
 
   ## Connecting from the BEAM
 
@@ -35,58 +36,50 @@ defmodule Hyper.Grpc do
     gRPC server configuration, read from application env:
 
         config :hyper, Hyper.Grpc,
-          enabled: true,
           port: 50_051,
           # any other GRPC.Server.Supervisor option, e.g. TLS:
           cred: GRPC.Credential.new(ssl: [certfile: "/path/cert.pem", keyfile: "/path/key.pem"])
 
-    `:enabled` (default `false`) gates whether the server starts. Every other
-    key is passed straight through to `GRPC.Server.Supervisor`, so operators
-    control the listener — port, TLS credentials, adapter options, body limits —
-    entirely from their own config. Hyper prescribes nothing beyond defaulting
-    `:port` and pointing the supervisor at `Hyper.Grpc.Endpoint`.
+    The server always runs (it is a core interface, not opt-in); this config
+    only tunes the listener. Every key is passed straight through to
+    `GRPC.Server.Supervisor`, so operators control port, TLS credentials,
+    adapter options, and body limits entirely from their own config. Hyper
+    prescribes nothing beyond defaulting `:port` and pointing the supervisor at
+    `Hyper.Grpc.Endpoint`.
 
     Load secrets however you like: put cert/key paths in `config/runtime.exs` and
     build the credential there, or read them from a vault — Hyper never touches
     the filesystem on your behalf.
+
+    > #### Co-located nodes {: .info}
+    >
+    > Every node binds `:port`. Running multiple nodes on one host (e.g. a local
+    > cluster) requires giving each a distinct port via its own config.
     """
 
     @default_port 50_051
 
-    @doc "Whether the gRPC server should start."
-    @spec enabled?() :: boolean()
-    def enabled?, do: Keyword.get(all(), :enabled, false)
-
     @doc """
     The options spliced into the `GRPC.Server.Supervisor` child: the operator's
-    config minus `:enabled`, with the endpoint, `start_server`, and a default
-    port filled in if absent.
+    config, with the endpoint, `start_server`, and a default port filled in if
+    absent.
     """
     @spec server_options() :: keyword()
     def server_options do
-      all()
-      |> Keyword.delete(:enabled)
+      Application.get_env(:hyper, Hyper.Grpc, [])
       |> Keyword.put_new(:endpoint, Hyper.Grpc.Endpoint)
       |> Keyword.put_new(:start_server, true)
       |> Keyword.put_new(:port, @default_port)
     end
-
-    @spec all() :: keyword()
-    defp all, do: Application.get_env(:hyper, Hyper.Grpc, [])
   end
 
   @doc """
-  The supervisor children for the gRPC server: empty unless the server is
-  enabled (see `Hyper.Grpc.Config`). Spliced into the app supervision tree by
-  `Hyper.Application`.
+  The gRPC server's supervisor child. Always present — the server is a core
+  interface, started unconditionally by `Hyper.Application`.
   """
-  @spec server_children() :: [Supervisor.child_spec() | {module(), term()}]
+  @spec server_children() :: [{module(), keyword()}]
   def server_children do
-    if Config.enabled?() do
-      [{GRPC.Server.Supervisor, Config.server_options()}]
-    else
-      []
-    end
+    [{GRPC.Server.Supervisor, Config.server_options()}]
   end
 
   @doc """