mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents keep their github token in /run, fetched on every start, not in the state dir

Browse source
This commit is contained in:
atlas 2026-11-15 02:04:04 +01:00 • committed by mara
commit 4bd02ea14d
1 changed files with 310 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/2-handbook/external-accounts/github.md
View file

@ -32,7 +32,7 @@ or the token fetch.
swarm-wide switch is the intended control.)
github.com only. The token **value** never touches nix — the agent writes it
to `<state>/github-token` at runtime (see [Provisioning](#provisioning)).
to a file under `/run` at runtime (see [Provisioning](#provisioning)).
## Provisioning
@ -44,13 +44,19 @@ no hive writes it. One token per agent: swarm-controller refuses to link
another until you delete the stored one, and no route hands it back.
The agent's `hive-agent-github-token` unit reads that path under the
agent's own store certificate and writes `<state>/github-token` (`0600`,
owned by the agent), on boot and every two minutes, replacing the file only
when the token changed. It needs a store identity
agent's own store certificate and writes `/run/hive-agent-github-token/token`
(`0400`, owned by the agent), on every start and every two minutes, replacing
the file only when the token changed. It needs a store identity
(`services.hyperhive.agent.bao.addr`); an agent without one gets no token.
The unit never deletes the file: a `github-token` already in place stays
when the store holds none or doesn't answer. Where the token lives and who
reads it: [credentials-reference.md](../../4-implementation/swarm/credentials-reference.md).
`/run` starts empty on every start, so the unit fetches the token anew each
time: an agent whose token you removed from the store has none after its next
start. When the
store doesn't answer at start, the agent boots and runs without a GitHub
token (`gh` and `git push` run unauthenticated, the unit logs one warning),
and the unit asks again until the store answers. Nothing reads the
`<state>/github-token` file an earlier version kept, and nothing deletes it;
it stays on disk, unused. Where the token lives and who reads it: [credentials-reference.md](../../4-implementation/swarm/credentials-reference.md).
## Security