mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

scope the cache access to hive-core: client-side nix copy, daemon trusts only the key

Browse source
This commit is contained in:
atlas 2026-11-07 15:25:30 +01:00 • committed by mara
commit dab7768869
1 changed files with 365 additions and 271 deletions
Download patch file Download diff file Expand all files Collapse all files

7
hive-priv-sock/src/lib.rs
View file

@ -289,7 +289,7 @@ pub enum PrivRequest {
},
/// Kept for an older hive-c0re that still asks hive-priv to download:
/// hive-c0re now pulls through the nix daemon and hive-priv downloads
/// hive-c0re now pulls with `nix copy --from` and hive-priv downloads
/// nothing. The answer is `Ok` when `store_path` is already in the store
/// and signed by the swarm cache's key (what `CreateContainer` and
/// `UpdateContainer` require), else an error that starts `not available: `.
@ -302,8 +302,9 @@ pub enum PrivRequest {
/// `systemctl start hive-priv-cache-facts.service`, bounded at 60 s: the
/// root unit that reads this hive's cache facts from the store and writes
/// the nix.conf fragment the daemon trusts. hive-c0re asks for it when the
/// fragment is missing. The request names no unit.
/// the swarm's key into the nix.conf fragment the daemon trusts and the pull
/// token into the netrc hive-c0re reads. hive-c0re asks for it when either is
/// missing. The request names no unit.
RefreshCacheFacts,
/// `nixos-container destroy <name>`