mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-archive: back up every agent's state to an append-only restic repository per agent

Browse source 
swarm-archive serves restic repositories with rclone, append-only, one login
and one repository per agent. swarm-controller writes each placed agent's
login and restic password to the store, replaces them on a move and removes
them when the agent is destroyed. Every hive backs its agents up hourly under
its own store identity. The archive host prunes by retention.
This commit is contained in:
atlas 2026-11-10 07:49:49 +01:00
commit 306aae0378
1 changed files with 2214 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/module-eval/hive-tls.nix
View file

@ -802,6 +802,31 @@ let
noService.systemd.services.hive-priv-cache-facts.environment.BAO_CLIENT_CERT
== "/etc/pki/bao-hive.pem";
}
{
# ./hive-archive-backup.nix. The grants are read under this hive's own
# identity and only from its own prefix; the swarm's password lives in no
# file and no unit text. The no-identity host is the control that the
# lookup is not always empty.
name = "the hive backs up its agents to the archive under its own identity, hourly, reading only its own grants";
ok =
let
u = units.hive-archive-backup;
t = allLocal.systemd.timers.hive-archive-backup;
in
lib.hasInfix "secret/swarm/hives/h1/archive" u.script
&& !(lib.hasInfix "swarm/services" u.script)
&& !(lib.hasInfix "swarm/hives/h2" u.script)
&& lib.hasInfix "rest:https://archive.t.local/" u.script
&& lib.hasInfix "RESTIC_PASSWORD_COMMAND=" u.script
&& lib.hasInfix "--exclude-caches" u.script
&& lib.hasInfix "for target in state claude harness" u.script
&& u.environment.BAO_CLIENT_CERT == units.hive-priv-cache-facts.environment.BAO_CLIENT_CERT
&& u.serviceConfig.Type == "oneshot"
&& t.timerConfig.OnCalendar == "hourly"
&& lib.elem "timers.target" t.wantedBy
&& !(noIdentity.systemd.services ? hive-archive-backup)
&& !(noIdentity.systemd.timers ? hive-archive-backup);
}
{
# Control: the lookup finds the sibling root unit of the same shape. The
# squid self-check's password is read under this hive's own identity and