vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the hive-c0re forge-credential chain nothing reads any more

Browse source 
With no nix build on the hive, the boot publish of the forge token for nix has no reader. Removes the ForgeSweep node, the token file, the git credential helper and hive-c0re's forge gitconfig sections.
This commit is contained in:
atlas 2026-10-29 22:55:31 +01:00
commit 221c3f35a1
10 changed files with 69 additions and 310 deletions
Download patch file Download diff file Expand all files Collapse all files

14
hive-c0re/src/forge/mod.rs
View file

@ -1,5 +1,5 @@
//! The hive's forge access: reads of the forge go through [`reader_token`] on
//! every hive, and [`ensure_all`] publishes that token for nix's `git`. The
//! every hive. The
//! swarm-wide orgs, teams and repos, and each agent's read grant on
//! `internal/docs`, are swarm-controller's. Full design:
//! `docs/integrations/forge.md`.
@ -10,7 +10,7 @@ mod reconcile;
mod repos;
pub(crate) use internal_meta::internal_meta_source;
pub use reader::{publish_nix_credential, reader_token};
pub use reader::reader_token;
pub use reconcile::{fetch_forge_main, reconcile_config_apply, reconcile_config_status};
pub use repos::{clone_config_into_proposed, fetch_config_main_into_applied};
@ -145,16 +145,6 @@ where
.map_err(|_| anyhow::anyhow!("{op}: no answer from the forge within {API_TIMEOUT:?}"))
}
/// Publish this hive's forge read token for nix's `git` at startup, so a build
/// that starts before any `internal/meta` read still has a credential. Every
/// hive runs it: the token is the hive's own, in the store, whether or not a
/// forge container is local.
pub async fn ensure_all() {
if publish_nix_credential().await {
tracing::debug!("forge: nix's forge credential is current");
}
}
#[cfg(test)]
mod tests {
use super::{API_TIMEOUT, bounded, git_url_with_base};

111
hive-c0re/src/forge/reader.rs
View file

@ -1,14 +1,6 @@
//! The credential this hive reads the forge with: its own read-only account,
//! whose token `swarm-controller` mints into the store at
//! `swarm/hives/<hive>/forge/token`.
//!
//! nix's `git` cannot reach the store, so [`ReaderToken::publish_for_nix`]
//! copies the token to a runtime file that `git-credential-hive-forge`
//! (`nix/host-modules/lib/hive-forge-git.nix`) reads.
use std::path::Path;
use anyhow::Result;
use super::basic_auth_header;
@ -39,30 +31,6 @@ impl ReaderToken {
pub(crate) fn api(&self) -> anyhow::Result<forgejo_api::Forgejo> {
super::api(&self.value)
}
/// Copy this token to the file nix's `git` authenticates from
/// ([`crate::paths::FORGE_HIVE_TOKEN`]). Whether the file now holds it; a
/// failed write is logged and leaves the file as it was.
pub(crate) fn publish_for_nix(&self) -> bool {
let path = Path::new(crate::paths::FORGE_HIVE_TOKEN);
match self.write_credential(path) {
Ok(()) => true,
Err(e) => {
tracing::warn!(path = %path.display(), error = ?e, "forge: could not write the nix forge credential");
false
}
}
}
/// Login on the first line, token on the second. Written only when the
/// content differs, so a build's resolve is not a disk write.
fn write_credential(&self, path: &Path) -> Result<()> {
let content = format!("{}\n{}\n", self.login, self.value);
if std::fs::read(path).is_ok_and(|have| have == content.as_bytes()) {
return Ok(());
}
crate::secret_file::write_secret_0600(path, content.as_bytes())
}
}
/// The token to read the forge with, or `None` when the store holds none for
@ -77,16 +45,6 @@ pub async fn reader_token() -> Option<ReaderToken> {
token
}
/// Publish this hive's read token for nix; see [`ReaderToken::publish_for_nix`].
/// Whether the file holds a token.
pub async fn publish_nix_credential() -> bool {
let Some(token) = reader_token().await else {
tracing::debug!("forge: no hive read token in the store; nix has no forge credential");
return false;
};
token.publish_for_nix()
}
/// This hive's token from the store, under the hive's own identity.
///
/// `None`, never an error, for every way it can come up empty — no hive name,
@ -131,8 +89,6 @@ async fn stored_reader_token() -> Option<ReaderToken> {
#[cfg(test)]
mod tests {
use super::*;
use std::os::unix::fs::PermissionsExt as _;
fn stored() -> ReaderToken {
ReaderToken {
login: "hive-alpha".to_owned(),
@ -140,73 +96,6 @@ mod tests {
}
}
fn mode(path: &Path) -> u32 {
std::fs::metadata(path).expect("stat").permissions().mode() & 0o777
}
#[test]
fn the_nix_credential_is_the_hives_login_then_its_token_at_0600() {
let dir = tempfile::tempdir().expect("tempdir");
let path = dir.path().join("forge-hive-token");
stored().write_credential(&path).expect("written");
assert_eq!(
std::fs::read_to_string(&path).expect("read"),
"hive-alpha\nfrom-the-store\n"
);
assert_eq!(mode(&path), 0o600);
}
#[test]
fn a_rotated_token_replaces_the_nix_credential() {
let dir = tempfile::tempdir().expect("tempdir");
let path = dir.path().join("forge-hive-token");
stored().write_credential(&path).expect("first");
let rotated = ReaderToken {
login: "hive-alpha".to_owned(),
value: "rotated".to_owned(),
};
rotated.write_credential(&path).expect("second");
assert_eq!(
std::fs::read_to_string(&path).expect("read"),
"hive-alpha\nrotated\n"
);
assert_eq!(mode(&path), 0o600);
}
#[test]
fn an_unchanged_credential_is_not_rewritten() {
let dir = tempfile::tempdir().expect("tempdir");
let path = dir.path().join("forge-hive-token");
stored().write_credential(&path).expect("first");
// A rewrite goes through a sibling temp file and a rename, which
// gives the file a new inode.
let before = std::fs::metadata(&path).expect("stat");
stored().write_credential(&path).expect("second");
let after = std::fs::metadata(&path).expect("stat");
assert_eq!(
std::os::unix::fs::MetadataExt::ino(&before),
std::os::unix::fs::MetadataExt::ino(&after)
);
}
/// `hive-forge-git.nix`'s credential helper names this path as a literal.
#[test]
fn the_nix_credential_lives_on_the_runtime_tmpfs_where_the_helper_reads_it() {
assert_eq!(
crate::paths::FORGE_HIVE_TOKEN,
"/run/hyperhive/forge-hive-token"
);
assert!(crate::paths::FORGE_HIVE_TOKEN.starts_with(crate::paths::RUNTIME_ROOT));
}
#[test]
fn a_path_that_cannot_be_written_is_an_error_not_a_panic() {
let dir = tempfile::tempdir().expect("tempdir");
let file = dir.path().join("a-file");
std::fs::write(&file, "").expect("file");
assert!(stored().write_credential(&file.join("sub")).is_err());
}
#[test]
fn the_header_names_the_tokens_own_account() {
use base64::Engine as _;

17
hive-c0re/src/job_queue/exec.rs
View file

@ -99,8 +99,6 @@ pub(super) trait Host: Sync {
async fn delete_state_subvolume(&self, name: &str) -> Result<()>;
/// The persistent directories a purge removes.
fn purge_dirs(&self, name: &str) -> Vec<PathBuf>;
/// Publish the hive's forge credential for nix.
async fn forge_ensure_all(&self);
/// One `/knowledge` pull.
async fn knowledge_pull(&self, coord: &Arc<Coordinator>) -> Result<()>;
/// One swarm wanted-state pull.
@ -228,10 +226,6 @@ impl Host for RealHost {
.collect()
}
async fn forge_ensure_all(&self) {
crate::forge::ensure_all().await;
}
async fn knowledge_pull(&self, coord: &Arc<Coordinator>) -> Result<()> {
crate::workers::knowledge::pull(coord).await
}
@ -332,23 +326,12 @@ async fn dispatch(
// `Finishing` so the nodes under it start. What they declare stays held
// until their whole subtree settles.
NodeKind::AgentWindow { .. } => Ok(()),
NodeKind::ForgeSweep => run_forge_sweep(host).await,
NodeKind::KnowledgePull => run_knowledge_pull(host, coord, KNOWLEDGE_PULL_DEADLINE).await,
NodeKind::WantedPull => run_wanted_pull(host, coord).await,
};
(builder, result)
}
/// Boot-time publish of the hive's forge credential for nix, as a DAG node —
/// see [`NodeKind::ForgeSweep`]. `forge::ensure_all` logs its own outcome and
/// is best-effort (a build re-publishes the credential before it fetches), so
/// this wrapper has nothing left to report; it exists to make the step a
/// visible unit of work.
async fn run_forge_sweep(host: &impl Host) -> Result<()> {
host.forge_ensure_all().await;
Ok(())
}
/// `/knowledge` pull as a DAG node — see [`NodeKind::KnowledgePull`]. Every
/// pass reports here, whoever submitted it: as the node's own error on the
/// dashboard, and into the debounced warning.

20
hive-c0re/src/job_queue/exec/tests.rs
View file

@ -12,9 +12,9 @@ use hive_jobq::scheduler::Scheduler;
use super::{
Host, dispatch, run_create, run_destroy_bookkeeping, run_destroy_container, run_drain,
run_emit_rebuilt, run_forge_sweep, run_knowledge_pull, run_meta_sync, run_pause_drain,
run_pause_signal, run_prebuild, run_provision, run_purge_state, run_rebuild_bookkeeping,
run_reconcile, run_set_wanted, run_signal, run_start, run_stop, run_stop_for_update, run_swap,
run_emit_rebuilt, run_knowledge_pull, run_meta_sync, run_pause_drain, run_pause_signal,
run_prebuild, run_provision, run_purge_state, run_rebuild_bookkeeping, run_reconcile,
run_set_wanted, run_signal, run_start, run_stop, run_stop_for_update, run_swap,
run_wanted_pull, run_write_dropin,
};
use crate::coordinator::{AgentPaths, Coordinator, HiveEnv};
@ -254,10 +254,6 @@ impl Host for FakeHost {
self.purge.clone()
}
async fn forge_ensure_all(&self) {
self.record("forge_ensure_all".to_owned());
}
async fn knowledge_pull(&self, _coord: &Arc<Coordinator>) -> anyhow::Result<()> {
if self.hang {
std::future::pending::<()>().await;
@ -1131,13 +1127,6 @@ async fn emit_rebuilt_reports_success_and_failure_under_one_key() {
// --- Sweeps and pulls ---------------------------------------------------------
#[tokio::test]
async fn forge_sweep_runs_once_and_never_fails() {
let host = FakeHost::up();
run_forge_sweep(&host).await.expect("ok");
assert_eq!(host.calls(), ["forge_ensure_all"]);
}
#[tokio::test]
async fn knowledge_pull_passes_the_result_through_and_times_out() {
let (_dir, coord) = coordinator();
@ -1305,7 +1294,6 @@ async fn dispatch_routes_each_host_backed_kind_to_its_executor() {
async fn dispatch_routes_the_agentless_and_hostless_kinds() {
let host = FakeHost::up();
for kind in [
NodeKind::ForgeSweep,
NodeKind::WantedPull,
NodeKind::KnowledgePull,
alice(|agent| NodeKind::AgentWindow { agent }),
@ -1325,7 +1313,7 @@ async fn dispatch_routes_the_agentless_and_hostless_kinds() {
);
}
let calls = host.calls();
for want in ["forge_ensure_all", "wanted_pull", "knowledge_pull"] {
for want in ["wanted_pull", "knowledge_pull"] {
assert!(calls.iter().any(|c| c == want), "{want} in {calls:?}");
}
}

5
hive-c0re/src/job_queue/model.rs
View file

@ -96,9 +96,6 @@ pub enum NodeKind {
/// Write the agent's durable power intent (`wanted = Up` when `up`,
/// else `Offline`) as the head node of a power-op DAG.
SetWanted { agent: String, up: bool },
/// One-shot boot-time publish of the hive's forge read token for nix
/// (`forge::ensure_all`). Agentless.
ForgeSweep,
/// `/knowledge` pull (`knowledge::pull`): at boot, on the swarm
/// knowledge-changed event, and hourly. Agentless.
KnowledgePull,
@ -165,7 +162,7 @@ impl NodeKind {
| NodeKind::AgentWindow { agent }
| NodeKind::EmitRebuilt { agent, .. }
| NodeKind::SetWanted { agent, .. } => agent,
NodeKind::ForgeSweep | NodeKind::KnowledgePull | NodeKind::WantedPull => "",
NodeKind::KnowledgePull | NodeKind::WantedPull => "",
}
}

7
hive-c0re/src/lifecycle/git.rs
View file

@ -10,9 +10,8 @@ use anyhow::{Context, Result, bail};
use tokio::io::{AsyncRead, AsyncReadExt};
use tokio::process::Command;
/// Deadline for a child that talks to a remote (forge fetch/push, `nix flake
/// update`/`lock`): a healthy one takes seconds, so ten minutes only ever
/// fires on a hang.
/// Deadline for a child that talks to a remote (forge fetch/push): a healthy
/// one takes seconds, so ten minutes only ever fires on a hang.
pub const FETCH_DEADLINE: Duration = Duration::from_mins(10);
/// Deadline for a git child that touches only the local repo.
@ -21,7 +20,7 @@ pub const GIT_LOCAL_DEADLINE: Duration = Duration::from_mins(2);
/// Run `cmd` to completion and capture its output, failing once `deadline`
/// passes. `what` names the command in the error. The child leads its own
/// process group and the whole group is `SIGKILL`ed on timeout, so a
/// grandchild (a `git` or credential helper under `nix`) dies with it instead
/// grandchild (a `git` or credential helper it spawned) dies with it instead
/// of outliving the lock.
pub async fn run_with_deadline(
cmd: &mut Command,

4
hive-c0re/src/main.rs
View file

@ -259,10 +259,6 @@ async fn cmd_serve(
tracing::warn!(error = ?e, "auto-update task failed");
}
});
// Forge credential publish: a `NodeKind::ForgeSweep` DAG node (see
// `workers::auto_update::submit_startup_sweep_nodes`), submitted
// unconditionally on every boot — moved off a bare `tokio::spawn` so it
// shows as real work on the dashboard.
// Knowledge periodic pull: hourly fallback in case a knowledge event from
// the swarm is missed (e.g. hive-c0re was down when it was sent). Sleeps
// before its first pull: the boot `NodeKind::KnowledgePull` DAG node

7
hive-c0re/src/paths.rs
View file

@ -196,13 +196,6 @@ pub fn gateway_agents_conf() -> PathBuf {
gateway_dir().join("agents.conf")
}
/// `forge-hive-token` — this hive's read-only forge token (login on the first
/// line, token on the second), copied from the swarm secret store for nix's
/// `git`. Tmpfs: re-published on every boot.
// nix: read by `git-credential-hive-forge`; the same literal is in
// `nix/host-modules/lib/hive-forge-git.nix` — must match.
pub const FORGE_HIVE_TOKEN: &str = "/run/hyperhive/forge-hive-token";
/// `attic/` — the swarm cache's pull credentials for the probe: `netrc`, `substituter`
/// and `public-key`, each `0600`, copied from the swarm secret store. Tmpfs:
/// re-published on every boot.

5
hive-c0re/src/stats/warnings.rs
View file

@ -172,9 +172,8 @@ pub fn snapshot() -> Vec<ServerWarning> {
/// Raise a warning for a one-shot boot-time step that has no periodic
/// retry to observe a later success and clear the warning via
/// [`WarningGuard`] drop — e.g. a step inside `forge::ensure_all()`,
/// which `tokio::spawn`s once at hive-c0re startup and never runs again
/// this process. Intentionally **leaks** the guard for the life of the
/// [`WarningGuard`] drop — e.g. a step that runs once at hive-c0re startup
/// and never again this process. Intentionally **leaks** the guard for the life of the
/// process: the warning clears the next time hive-c0re restarts (a fresh
/// process starts with an empty registry) and re-runs the step, which is
/// exactly when a config/environment fix would take effect anyway.

7
hive-c0re/src/workers/auto_update.rs
View file

@ -196,13 +196,13 @@ fn boot_action(wanted: Option<crate::power::Wanted>, fresh: bool, running: bool)
}
}
/// Submit the boot-time forge/knowledge/wanted-state sweeps as DAG
/// nodes — `ForgeSweep`, `KnowledgePull`, `WantedPull`. Unlike
/// Submit the boot-time knowledge and wanted-state sweeps as DAG
/// nodes — `KnowledgePull`, `WantedPull`. Unlike
/// [`submit_boot_tree`] this runs on **every** boot, quiet or not: these
/// aren't config-drift work, they're startup housekeeping that always needs
/// to happen, and the point of moving them here is exactly so they show up
/// as real work on the dashboard instead of an invisible `tokio::spawn` that
/// only surfaces on failure. Three independent, build-slot- and lease-exempt
/// only surfaces on failure. Independent, build-slot- and lease-exempt
/// roots — no dependency edges between them, matching the existing
/// `Reconcile`-root pattern in [`boot_nodes`]. `KnowledgePull` holds its
/// sweep's own resource, so it queues behind any pass of the same sweep
@ -211,7 +211,6 @@ fn submit_startup_sweep_nodes(coord: &Arc<Coordinator>) {
use crate::job_queue::NodeKind;
if let Err(e) = coord.job_queue.insert_job(|b| {
let _ = b.node(NodeKind::ForgeSweep);
let _ = crate::job_queue::templates::knowledge_pull(b);
let _ = b.node(NodeKind::WantedPull);
Vec::new()