mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-stt: the deploy module (deploy.stt.*, sandboxed container, store leaf, queue grants) and its docs

Browse source
This commit is contained in:
damocles 2026-11-12 08:36:32 +01:00 • committed by mara
commit 96b5b83fa4
5 changed files with 594 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nix/module-eval/bao-grants.nix
View file

@ -194,6 +194,7 @@ let
"swarm-bao-ci-metrics-policy"
"swarm-bao-claude-login-policy"
"swarm-bao-notify-router-policy"
"swarm-bao-stt-policy"
"swarm-bao-attic-policy"
"swarm-bao-archive-policy"
];
@ -2183,6 +2184,27 @@ let
&& lib.hasInfix "allowed_common_names=swarm-notify-router" s
&& lib.hasInfix "token_policies=swarm-notify-router" s;
}
{
name = "the speech-to-text service's grant is read on its own queue client secret alone";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-stt-policy.script;
grants = grantsIn s;
in
(grantFor grants "secret/data/swarm/services/swarm-stt/oidc/client").caps == [ "read" ]
&& lib.length grants == 1
&& lib.hasInfix "auth/cert/certs/swarm-stt" s
&& lib.hasInfix "allowed_common_names=swarm-stt" s
&& lib.hasInfix "token_policies=swarm-stt" s;
}
{
name = "the PKI unit signs the speech-to-text service's leaf under its own subject";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-pki.script;
in
lib.hasInfix "/stt.pem ]" s && lib.hasInfix "swarm-stt \"\" clientAuth" s;
}
{
name = "the PKI unit signs the notification router's leaf under its own subject";
ok =

1
nix/module-eval/core-toggle.nix
View file

@ -2286,6 +2286,7 @@ let
"swarm-notify-router"
"swarm-otel"
"swarm-review-classifier"
"swarm-stt"
"swarm-victorialogs"
"swarm-victoriametrics"
]

7
nix/module-eval/nats-authelia.nix
View file

@ -106,6 +106,12 @@ let
credential = "notify-router-bao";
port = 8902;
}
{
machine = "swarm-stt";
name = "stt";
credential = "stt-bao";
port = 8904;
}
];
forwarderFetchDir = "/run/credentials/swarm-journal-forwarder-oidc.service";
@ -545,6 +551,7 @@ let
"'$$JS.API.CONSUMER.CREATE.ROUTER_TODOS.todo-{agent}.$$SWARM.router.todo.{agent}'"
"'$$JS.API.CONSUMER.MSG.NEXT.ROUTER_TODOS.todo-{agent}'"
"'$$JS.ACK.ROUTER_TODOS.todo-{agent}.>'"
"'$$SWARM.stt.transcribe.{agent}'"
];
}
{

1
nix/module-eval/semi-spread.nix
View file

@ -219,6 +219,7 @@ let
d.victorialogs.enable
d.review-classifier.enable
d.notify-router.enable
d.stt.enable
d.claude-login.enable
d.ci-metrics.enable
(!d.bao.enable)

34
nix/module-eval/swarm-services-switch.nix
View file

@ -177,7 +177,7 @@ let
# Every service container at once: the services-only host plus the CI
# runner. The CI runner, the review classifier, the notification router, the
# builder, the claude login minter, the metrics store, the homeserver,
# authelia, Grafana, the collector and the cache are the eleven containers on
# authelia, Grafana, the collector and the cache are the twelve containers on
# a netns of their own.
serviceContainersWithCi = hive {
deploy.hive-controller.enable = false;
@ -204,6 +204,7 @@ let
"swarm-notify-router"
"swarm-otel"
"swarm-review-classifier"
"swarm-stt"
"swarm-victorialogs"
"swarm-victoriametrics"
];
@ -429,6 +430,25 @@ let
&& !(sc.DynamicUser or false)
&& swarmServicesHere.services.hyperhive.deploy.nats.enable;
}
{
name = "hosting the swarm's shared services runs the speech-to-text service as an unprivileged user under a sandbox";
ok =
let
c = swarmServicesHere.containers.swarm-stt.config;
sc = c.systemd.services.swarm-stt.serviceConfig;
in
swarmServicesHere.services.hyperhive.deploy.stt.enable
&& c.users.users.swarm-stt.isSystemUser
&& sc.User == "swarm-stt"
&& !(sc.DynamicUser or false)
&& sc.NoNewPrivileges
&& sc.ProtectSystem == "strict"
&& sc.PrivateTmp
&& sc.CapabilityBoundingSet == ""
&& sc.MemoryMax == "3G"
&& sc.StateDirectory == "swarm-stt"
&& c.systemd.services.swarm-stt.environment.SWARM_STT_MAX_WAITING == "3";
}
{
# dhcpcd without IPv4LL, waiting for IPv4: `network-online` is a lease.
# The router sets no `nohook` itself and authelia does; `nohook` is the
@ -454,6 +474,12 @@ let
&& lib.elem "network-online.target" fetch.after
&& lib.elem "network-online.target" fetch.wants;
}
{
name = "the speech-to-text service stays off where the shared services are hosted without the store";
ok =
!swarmServicesBaoElsewhere.services.hyperhive.deploy.stt.enable
&& !(swarmServicesBaoElsewhere.containers ? swarm-stt);
}
{
name = "the notification router stays off where the shared services are hosted without the store";
ok =
@ -810,15 +836,15 @@ let
# that lost a container can't pass by comparing fewer of them.
name = "every service container restates its host-side privateNetwork";
ok =
lib.length (lib.attrNames serviceContainers) == 15
lib.length (lib.attrNames serviceContainers) == 16
&& lib.all (
c: c.privateNetwork == (c.config.services.hyperhive.swarmContainer.privateNetwork or null)
) (lib.attrValues serviceContainers);
}
{
# Both values come from ../container-modules/swarm-container.nix.
# Four of the 15 service containers share the host netns (hive-forge, bao,
# the queue, the log store) and eleven have one of their own.
# Four of the 16 service containers share the host netns (hive-forge, bao,
# the queue, the log store) and twelve have one of their own.
name = "a service container on the host netns runs no firewall or resolvconf of its own";
ok =
let