144 lines
6.6 KiB
Nix
144 lines
6.6 KiB
Nix
# GitHub integration (services.hyperhive.agent.github.enable): a `gh` wrapper + a git
|
|
# credential helper, both reading the PAT from `github.tokenFile` (the file
|
|
# ./github-token.nix fetches into under `/run`) at invocation, so a fetched
|
|
# token takes effect with no rebuild. The token PATH is baked in at build
|
|
# time — NOT read from an env var, because claude's Bash tool runs `bash -c`
|
|
# in a minimal env that doesn't source `/etc/set-environment`, so the env var
|
|
# isn't present where `gh`/`git` actually run. The token value never enters
|
|
# the nix store (only its path). github.com only; git auths as
|
|
# `x-access-token` + PAT.
|
|
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
userName = config.services.hyperhive.agent.user.name;
|
|
tokenFile = config.services.hyperhive.agent.github.tokenFile;
|
|
ghWrapper = pkgs.writeShellScriptBin "gh" ''
|
|
if [ -r "${tokenFile}" ]; then
|
|
GH_TOKEN="$(cat "${tokenFile}")"
|
|
export GH_TOKEN
|
|
fi
|
|
exec ${pkgs.gh}/bin/gh "$@"
|
|
'';
|
|
gitCredHelper = pkgs.writeShellScriptBin "git-credential-hive-github" ''
|
|
# git credential-helper protocol: only the `get` action needs an answer.
|
|
[ "''${1:-}" = "get" ] || exit 0
|
|
if [ -r "${tokenFile}" ]; then
|
|
# GitHub ignores the username for PAT auth — `x-access-token` is the
|
|
# conventional placeholder; the PAT is the password.
|
|
printf 'username=x-access-token\n'
|
|
printf 'password=%s\n' "$(cat "${tokenFile}")"
|
|
fi
|
|
'';
|
|
in
|
|
{
|
|
options.services.hyperhive.agent.github.enable = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = ''
|
|
Install the GitHub integration in this agent: a `gh` CLI wrapper and a
|
|
git credential helper for `https://github.com`, both authenticated from
|
|
an operator-supplied personal access token (PAT). The operator links the
|
|
PAT in the swarm UI, and the agent fetches it from the swarm secret store
|
|
into `/run` (needs `services.hyperhive.agent.bao.addr`),
|
|
so giving an agent GitHub is a runtime action, no per-agent config or
|
|
rebuild. The wrappers read the token file at invocation, so a fetched
|
|
PAT takes effect immediately; until one exists, `gh` / `git push` just
|
|
fail unauthenticated.
|
|
|
|
github.com only. git authenticates as `x-access-token` + the PAT (GitHub
|
|
ignores the username for PAT auth); `gh` derives its identity from the
|
|
token. Keep the PAT minimally scoped: the agent has passwordless sudo, so
|
|
a compromised agent can act within the token's scopes --- scope is the
|
|
real blast-radius limiter.
|
|
|
|
On by default. Host-driven: set `services.hyperhive.swarm.github.enable = false`
|
|
to turn the integration off swarm-wide (meta.rs propagates the override
|
|
into every agent).
|
|
'';
|
|
};
|
|
|
|
config = {
|
|
# No bare pkgs.gh here — the wrapper *is* `gh` and hardcodes the
|
|
# real binary path, so it can't be shadowed.
|
|
environment.systemPackages = lib.optionals config.services.hyperhive.agent.github.enable [
|
|
ghWrapper
|
|
gitCredHelper
|
|
];
|
|
|
|
# Wire the GitHub credential helper for `git push` over HTTPS. Host-scoped
|
|
# to `https://github.com`, so it never touches the forge (localhost:3000)
|
|
# or any other remote. The helper reads the PAT from the agent's
|
|
# `github.tokenFile` at invocation and auths as `x-access-token` +
|
|
# the PAT. System /etc/gitconfig merges under the agent's ~/.gitconfig
|
|
# (safe.directory), so this is additive.
|
|
# Nested-path binding + mkIf (matching the other `environment.etc."…"`
|
|
# entries in the harness modules) — a whole-set `environment.etc = {…}`
|
|
# here would collide with them at the nix level ("attribute already
|
|
# defined").
|
|
environment.etc."gitconfig" = lib.mkIf config.services.hyperhive.agent.github.enable {
|
|
text = ''
|
|
[credential "https://github.com"]
|
|
helper = hive-github
|
|
username = x-access-token
|
|
'';
|
|
};
|
|
|
|
# GitHub notification poller — the github.com sibling of
|
|
# `hive-forge-notify` (forge.nix). Same delivery path: unread list ->
|
|
# per-thread summary -> todo on the harness's in-agent socket.
|
|
#
|
|
# Its own binary and its own package, so the deployment decides
|
|
# whether an agent gets GitHub notifications at all — the unit is
|
|
# installed or it isn't. That keeps the choice here rather than in a
|
|
# cargo feature, which would unify across the workspace and stop the
|
|
# two builds sharing any cached crate.
|
|
#
|
|
# The separate package is what makes that real: the per-bin
|
|
# extractor copies exactly one binary, so an agent that installs
|
|
# only the Forgejo poller has no github.com poller anywhere in its
|
|
# closure — not merely an unstarted unit.
|
|
systemd.services.hive-github-notify = lib.mkIf config.services.hyperhive.agent.github.enable {
|
|
description = "github.com notification poller for this agent";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
environment = {
|
|
# Same in-agent todo socket the forge poller and the harness use
|
|
# (agent-service.nix) — one todo stream, two producers.
|
|
HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
|
|
RUST_LOG = "info";
|
|
# The file ./github-token.nix fetches the PAT into; a path, never the value.
|
|
HIVE_GITHUB_TOKEN_FILE = tokenFile;
|
|
};
|
|
serviceConfig = {
|
|
ExecStart = "${config.services.hyperhive.agent.packages.hive-github-notify}/bin/hive-github-notify";
|
|
SyslogIdentifier = "hive-github-notify";
|
|
# `on-failure`, NOT `always`, for the same reason as the forge
|
|
# poller: this unit ships on every agent, but most agents have no
|
|
# PAT. The poller reports that by logging why and exiting 0, which
|
|
# under `always` would become a restart loop on every PAT-less
|
|
# agent. A crash still restarts.
|
|
Restart = "on-failure";
|
|
RestartSec = 5;
|
|
User = userName;
|
|
Group = userName;
|
|
};
|
|
};
|
|
|
|
# Starts the poller when the token appears after it gave up waiting for one
|
|
# (about ten minutes, then exit 0, which `on-failure` does not restart).
|
|
# The operator places the PAT through the swarm after the agent runs, so
|
|
# that is the usual order. A path unit starts its service only when it is
|
|
# not running. `PathChanged=` because the fetch renames the file into place,
|
|
# and a `PathExists=` that already holds would re-fire on every re-arm.
|
|
# Gated on the service it triggers.
|
|
systemd.paths.hive-github-notify = lib.mkIf config.services.hyperhive.agent.github.enable {
|
|
description = "start hive-github-notify when the GitHub token appears";
|
|
wantedBy = [ "multi-user.target" ];
|
|
pathConfig.PathChanged = tokenFile;
|
|
};
|
|
};
|
|
}
|