vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hivectl: collapse infra allowlist + restart/control ops onto SIBLING_CONTAINERS

Browse source 
Per review: RESTARTABLE_INFRA_CONTAINERS and the new CONTROLLABLE_INFRA_CONTAINERS
were near-identical subsets of SIBLING_CONTAINERS. Drop both and validate infra
lifecycle ops against SIBLING_CONTAINERS directly (all four infra containers;
hive-c0re is never in it, so it can't stop itself). This also makes hive-matrix
restartable, including via an infra_admin agent's restart tool.

Collapse the two priv ops too: RestartInfraContainer is gone; ControlInfraContainer
{ action } is the single op (restart = action: Restart). priv_client's
restart_infra_container is now a thin wrapper over control_infra_container.
This commit is contained in:
atlas 2026-06-19 00:50:00 +02:00 • committed by mara
commit 0df9e40940
4 changed files with 46 additions and 109 deletions
Download patch file Download diff file Expand all files Collapse all files

20
hive-c0re/src/priv_client.rs
View file

@ -283,24 +283,20 @@ pub async fn restart_matrix_daemon(agent_name: &str) -> Result<()> {
.await?)
}
/// Restart a hive infrastructure container (hive-ci / hive-gateway /
/// hive-forge) on the host via `systemctl restart
/// container@<container>.service`. hive-priv re-validates `container`
/// against its root-side allowlist; callers must already have checked
/// the requesting agent holds the `infra_admin` capability.
/// Restart a hive infrastructure container on the host (thin wrapper over
/// [`control_infra_container`] with `action = Restart`). hive-priv
/// re-validates `container` against its root-side allowlist; callers must
/// already have checked the requesting agent holds the `infra_admin`
/// capability.
pub async fn restart_infra_container(container: &str) -> Result<()> {
ok(call(&PrivRequest::RestartInfraContainer {
container: container.to_owned(),
})
.await?)
control_infra_container(container, InfraAction::Restart).await
}
/// Start / stop / restart a hive infrastructure container (`hive-ci`,
/// `hive-gateway`, `hive-forge`, `hive-matrix`) on the host via `systemctl
/// <action> container@<container>.service`. hive-priv re-validates
/// `container` against its root-side allowlist
/// (`CONTROLLABLE_INFRA_CONTAINERS`). Used by the hive-wide `hivectl stop` /
/// `hivectl start` flow.
/// `container` against its root-side allowlist (`SIBLING_CONTAINERS`). Used
/// by the hive-wide `hivectl stop` / `hivectl start` flow.
pub async fn control_infra_container(container: &str, action: InfraAction) -> Result<()> {
ok(call(&PrivRequest::ControlInfraContainer {
container: container.to_owned(),