mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents keep their github token in /run, fetched on every start, not in the state dir

Browse source
This commit is contained in:
atlas 2026-11-15 02:04:04 +01:00 • committed by mara
commit 4bd02ea14d
1 changed files with 310 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

63
nix/agent-modules/github-token.nix
View file

@ -4,12 +4,18 @@
# An operator links the token in the swarm UI; `swarm-controller` stores it at
# `swarm/agents/<agent>/github-token` (`swarm_secret_client::github`). The
# agent's own read grant covers that path, so this unit reads it and writes
# `<state>/github-token`, which the `gh` wrapper, the git credential helper and
# `hive-github-notify` read.
# `services.hyperhive.agent.github.tokenFile`, under `/run`, which the `gh`
# wrapper, the git credential helper and `hive-github-notify` read.
#
# It never deletes. A `github-token` already in place stays when the store has
# none or cannot be read. The file is replaced by rename, and only when its
# bytes changed.
# `/run` is empty at every start, so the token is fetched anew each time and a
# token removed from the store is gone at the next start. A store that does not
# answer leaves the agent without a token until it does; the timer below asks
# again. Nothing reads the `github-token` file an earlier version kept in the
# state dir, and nothing deletes it.
#
# Within one run, a token already fetched stays when the store has none or
# cannot be read. The file is replaced by rename, and only when its bytes
# changed.
{
pkgs,
lib,
@ -20,7 +26,6 @@ let
cfg = config.services.hyperhive.agent.bao;
agentName = config.services.hyperhive.agent.user.name;
stateDir = "/agents/${agentName}/state";
# The server CA id ./bao.nix loads.
serverCaCredential = "hive-agent-bao-server-ca";
@ -32,19 +37,36 @@ let
tokenPath = "secret/swarm/agents/${agentName}/github-token";
runtimeDir = unitName;
tokenFile = "/run/${runtimeDir}/token";
# Beside the token, so the rename that replaces it stays in one directory.
stagedFile = "/run/${runtimeDir}/token.new";
# The store's whole answer, token included: kept in the unit's own `0700`
# directory, never in the state dir.
# directory.
rawFile = "/run/${runtimeDir}/account.json";
errFile = "/run/${runtimeDir}/bao.err";
tokenFile = "${stateDir}/github-token";
stagedFile = "${stateDir}/.github-token.new";
configured = cfg.addr != null && config.services.hyperhive.agent.github.enable;
storeRetry = import ../host-modules/lib/store-retry.nix { };
in
{
options.services.hyperhive.agent.github.tokenFile = lib.mkOption {
type = lib.types.str;
readOnly = true;
default = tokenFile;
description = ''
Path this agent's GitHub token is fetched to. Read-only: it is a fact
about where `${unitName}.service` writes, not a knob.
🩸 A PATH and never a value. The file is `0400` to the agent user and
lives on `/run`, so it is gone whenever the agent's container restarts.
The file exists only once an operator has linked a token and the agent
has a store identity to fetch it with. Until then `gh` and `git push`
run unauthenticated.
'';
};
config = lib.mkIf configured {
systemd.services.${unitName} = {
description = "fetch this agent's GitHub token from the secret store";
@ -67,14 +89,19 @@ in
serviceConfig = storeRetry.serviceConfig // {
Type = "oneshot";
# Not `RemainAfterExit`, so the timer below can start it again.
# `RuntimeDirectoryPreserve` is what keeps the directory, and the
# token in it, alive between runs instead.
RemainAfterExit = false;
TimeoutStartSec = 30;
User = agentName;
Group = agentName;
RuntimeDirectory = runtimeDir;
RuntimeDirectoryMode = "0700";
# `0600`, the mode `github-token` has.
UMask = "0077";
RuntimeDirectoryPreserve = "yes";
# Every file this script creates is `0400`, so only the redirect that
# creates a file can write to it: each is removed before it is
# written.
UMask = "0377";
LoadCredential = [ serverCaCredential ];
};
environment = {
@ -88,7 +115,7 @@ in
# No identity delivered: ./bao.nix's check reports that.
for f in "$BAO_CLIENT_CERT" "$BAO_CLIENT_KEY"; do
if [ ! -s "$f" ]; then
echo "this agent has no store identity, so it cannot fetch its GitHub token." >&2
echo "this agent has no store identity, so it runs without a GitHub token." >&2
exit 0
fi
done
@ -103,17 +130,19 @@ in
token=${lib.escapeShellArg tokenFile}
trap 'rm -f "$err" "$raw" "$staged"' EXIT
rm -f "$err"
if ! BAO_TOKEN="$(bao login -method=cert -token-only 2>"$err")"; then
echo "the swarm secret store at $BAO_ADDR did not accept this agent's certificate login:" >&2
echo "the swarm secret store at $BAO_ADDR did not accept this agent's certificate login; this agent runs without a GitHub token until it does:" >&2
if [ -s "$err" ]; then cat "$err" >&2; fi
exit 1
fi
export BAO_TOKEN
# No token linked and a store that cannot answer look alike here, and
# either way the file in place, if any, is kept.
# either way a token fetched earlier in this run, if any, is kept.
rm -f "$err" "$raw"
if ! bao kv get -format=json ${lib.escapeShellArg tokenPath} >"$raw" 2>"$err"; then
echo "no GitHub token read from ${tokenPath}; github-token left as it is:" >&2
echo "no GitHub token read from ${tokenPath}; this agent runs without one until the store has one:" >&2
if [ -s "$err" ]; then cat "$err" >&2; fi
exit 0
fi
@ -123,7 +152,7 @@ in
# failing the unit would only restart it into the same answer.
rm -f "$staged"
if ! jq -er '.data.data.value | strings' "$raw" >"$staged"; then
echo "${tokenPath} holds no string value; github-token left as it is." >&2
echo "${tokenPath} holds no string value; this agent runs without a GitHub token." >&2
exit 0
fi