mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarmctl: interactive setup walks the first-run ceremony

Browse source 
swarmctl setup with no subcommand checks the setup status first, then takes the open steps one at a time: prompts for input, shows a running action as one live line, prints the store keys, root token and new password under a warning until the operator confirms, and names the deploy option for a step this host cannot do. It calls the code of bao init, bao grant-bootstrap, user add, forge make-admin, agent create, agent permissions set and agent set-state. Refuses without root or a terminal.
This commit is contained in:
atlas 2026-11-08 13:28:09 +01:00 • committed by mara
commit 44caa72c19
1 changed files with 2172 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

31
swarmctl/README.md
View file

@ -207,6 +207,35 @@ schedule does once stored is in
[`docs/2-handbook/swarm/schedules.md`](../docs/2-handbook/swarm/schedules.md). The bodies come
from `swarm-controller-api`, imported in `src/schedule.rs`.
## `setup`
```console
# swarmctl setup
```
Walks the first-run ceremony of
[`docs/1-getting-started/setup.md`](../docs/1-getting-started/setup.md) as root, in a terminal. It
reads the same checks as `setup status` first, so a rerun skips the steps that are done and
continues at the first one left. Each step shows as `Step n of N`, with the number still to do.
- **Prompts.** Whatever a step needs, such as the SSO account's username, display name and email,
the root token (hidden), or the hive for ruth, it asks for.
- **Live line.** A running action shows as one spinner line with its elapsed time. A failure
prints the whole error and offers retry, skip or quit.
- **Warnings.** The secret store's keys and root token, and the new account's password, print once
under yellow ⚠️ warnings and stay on screen until you type `yes` to say you stored them. swarmctl
writes them nowhere. `NO_COLOR` and a non-terminal turn the colour off.
- **Not on this host.** A step whose service this host does not run is listed with the deploy option
it needs (`services.hyperhive.deploy.bao.enable`, `deploy.authelia.enable`,
`deploy.swarm-controller.enable`) and the host to run `swarmctl setup` on.
- **No verb yet.** Unsealing a `shamir` store, restarting the granting units and the browser login
print the command or instruction and wait for you to confirm, then check again.
The steps call the code of the `bao init`, `bao grant-bootstrap`, `user add`, `forge make-admin` and
`agent create` verbs, plus `agent permissions set` and `agent set-state` for ruth. They never run
`swarmctl` again. Without a terminal, or without root, it refuses; scripts use `setup status`
and the verbs. The flow is `src/interactive.rs`; the terminal and side effects are `src/terminal.rs`.
## `setup status`
```console
@ -240,7 +269,7 @@ is optional and does not count.
## Remote use: `swarmctl login`
The `agent`, `schedule` and `forge` verbs, and the agent checks of `setup status`, also work from any machine, as
The `agent`, `schedule` and `forge` verbs, and the agent checks and steps of `setup`, also work from any machine, as
your own SSO account, through the swarm domain's gateway:
```console