mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-archive: back up every agent's state to an append-only restic repository per agent

Browse source 
swarm-archive serves restic repositories with rclone, append-only, one login
and one repository per agent. swarm-controller writes each placed agent's
login and restic password to the store, replaces them on a move and removes
them when the agent is destroyed. Every hive backs its agents up hourly under
its own store identity. The archive host prunes by retention.
This commit is contained in:
atlas 2026-11-10 07:49:49 +01:00
commit 306aae0378
1 changed files with 2214 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

39
nix/module-eval/builder.nix
View file

@ -561,6 +561,45 @@ let
&& names atticExternal == names bare
&& !(lib.elem "cache.example.org" (names atticExternal));
}
{
# The archive on the host that hosts the shared services. Append-only and
# private repos are what make one hive's compromise and one agent's
# login small; the control is the bare host, which runs no archive.
name = "the archive serves append-only with private repositories behind a TLS-only vhost, and a host without it renders none";
ok =
let
a = atticHere.systemd.services.swarm-archive;
users = atticHere.systemd.services.swarm-archive-users;
prune = atticHere.systemd.services.swarm-archive-prune;
vhost = atticHere.services.hyperhive.gateway.vhosts."archive.t.local";
cfg = atticHere.services.hyperhive.deploy.archive;
names = m: m.services.hyperhive.swarm.serviceDomains;
in
atticHere.services.hyperhive.deploy.archive.enable
&& lib.hasInfix "--append-only" a.serviceConfig.ExecStart
&& lib.hasInfix "--private-repos" a.serviceConfig.ExecStart
&& lib.hasInfix "--htpasswd /run/swarm-archive-auth/htpasswd" a.serviceConfig.ExecStart
&& lib.hasInfix "/var/lib/swarm-archive/repos" a.serviceConfig.ExecStart
&& a.serviceConfig.User == "swarm-archive"
&& vhost.forceSSL
&& !(lib.hasInfix "auth_request" vhost.locations."/".extraConfig)
&& vhost.locations."/".proxyPass == "http://127.0.0.1:8911"
&& lib.elem "archive.t.local" (names atticHere)
&& names atticHere == names bare
&& cfg.retention.keepWithin == "3d"
&& cfg.retention.keepLast == 3
&& lib.hasInfix "--keep-last 3 --keep-within 3d --prune" prune.script
&& prune.serviceConfig.User == "swarm-archive"
&& lib.hasInfix "RESTIC_PASSWORD_COMMAND=" prune.script
&& lib.hasInfix "secret/swarm/services/archive/users" users.script
&& users.environment.BAO_CLIENT_CERT == "/var/lib/swarm-bao-pki/archive.pem"
&& !(lib.hasInfix "password" (lib.toLower (builtins.toJSON a.environment)))
&& atticHere.systemd.timers ? swarm-archive-users
&& atticHere.systemd.timers.swarm-archive-prune.timerConfig.OnCalendar == "daily"
&& lib.elem "swarm-bao-archive-policy.service" users.after
&& !(bare.systemd.services ? swarm-archive)
&& !(bare.systemd.services ? swarm-archive-users);
}
];
in
runGroup "builder" cases