mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents keep their github token in /run, fetched on every start, not in the state dir

Browse source
This commit is contained in:
atlas 2026-11-15 02:04:04 +01:00 • committed by mara
commit 4bd02ea14d
1 changed files with 310 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

53
nix/module-eval/agent-github-bao.nix
View file

@ -3,7 +3,7 @@
# not executes").
#
# The agent side of the swarm-stored GitHub token: ../agent-modules/github-token.nix
# fetches it into the file ../agent-modules/github.nix's readers use.
# fetches it into the `/run` file ../agent-modules/github.nix's readers use.
{
pkgs,
lib,
@ -44,6 +44,7 @@ let
hasTimer = machine: machine.systemd.timers ? hive-agent-github-token;
in
let
tokenFile = "/run/hive-agent-github-token/token";
cases = [
{
name = "an agent with a store address and the integration on fetches its github token";
@ -60,19 +61,49 @@ let
{
# The nix half of `swarm_secret_client::github::account_path`, and the
# file ./github.nix's `gh` wrapper, credential helper and poller read.
name = "the fetch reads the agent's own github-token path into its state-dir file";
name = "the fetch reads the agent's own github-token path into a file under /run";
ok =
let
name = agentGithubBao.services.hyperhive.agent.user.name;
s = (fetchUnit agentGithubBao).script;
in
lib.hasInfix "bao kv get -format=json secret/swarm/agents/${name}/github-token >" s
&& lib.hasInfix "token=/agents/${name}/state/github-token" s
&& lib.hasInfix ".data.data.value | strings" s;
&& lib.hasInfix "token=${tokenFile}" s
&& lib.hasInfix ".data.data.value | strings" s
&& agentGithubBao.services.hyperhive.agent.github.tokenFile == tokenFile;
}
{
# The agent user owns its state dir (./user.nix), and the file keeps
# its `0600` mode.
# The presence arms are the `${tokenFile}` matches above and below: the
# unit and the path unit do name the `/run` file, so a state-dir path
# missing here is a fact and not a misspelled lookup.
name = "neither the fetch nor the poller's units name the state-dir github-token";
ok =
let
name = agentGithubBao.services.hyperhive.agent.user.name;
stateToken = "/agents/${name}/state/github-token";
notify = agentGithubBao.systemd.services.hive-github-notify;
path = agentGithubBao.systemd.paths.hive-github-notify;
in
!(lib.hasInfix "/state" (fetchUnit agentGithubBao).script)
&& notify.environment.HIVE_GITHUB_TOKEN_FILE == tokenFile
&& path.pathConfig.PathChanged == tokenFile
&& path.pathConfig.PathChanged != stateToken;
}
{
# `/run` is empty at every start, so a token the store no longer has is
# gone then; the preserved directory keeps it between this unit's runs.
name = "the token file lives in a preserved 0700 runtime directory and is 0400";
ok =
let
u = fetchUnit agentGithubBao;
in
u.serviceConfig.RuntimeDirectory == "hive-agent-github-token"
&& u.serviceConfig.RuntimeDirectoryMode == "0700"
&& u.serviceConfig.RuntimeDirectoryPreserve == "yes"
&& u.serviceConfig.UMask == "0377";
}
{
# The runtime directory is the agent user's.
name = "the fetch runs as the agent, with its own store identity";
ok =
let
@ -80,15 +111,14 @@ let
name = agentGithubBao.services.hyperhive.agent.user.name;
in
u.serviceConfig.User == name
&& u.serviceConfig.UMask == "0077"
&& u.environment.BAO_ADDR == baoAddr
&& u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
&& u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key";
}
{
# A file a hive wrote keeps working until the operator links a token in
# the swarm UI.
name = "the fetch never deletes the state-dir token, and swaps it in only on a change";
# The fetch itself is run, against a stub store, by
# `checks.script-test-agent-bao-fetch`.
name = "the fetch never deletes the token, and swaps it in only on a change";
ok =
let
s = (fetchUnit agentGithubBao).script;
@ -108,10 +138,9 @@ let
name = "a token that lands after the github poller gave up starts it again";
ok =
let
name = agentGithubBao.services.hyperhive.agent.user.name;
path = agentGithubBao.systemd.paths.hive-github-notify;
in
path.pathConfig.PathChanged == "/agents/${name}/state/github-token"
path.pathConfig.PathChanged == tokenFile
&& path.wantedBy == [ "multi-user.target" ]
&& agentGithubBao.systemd.services ? hive-github-notify
&& !(agentGithubOff.systemd.paths ? hive-github-notify)