vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the hive-c0re forge-credential chain nothing reads any more

Browse source 
With no nix build on the hive, the boot publish of the forge token for nix has no reader. Removes the ForgeSweep node, the token file, the git credential helper and hive-c0re's forge gitconfig sections.
This commit is contained in:
atlas 2026-10-29 22:55:31 +01:00
commit 221c3f35a1
2 changed files with 69 additions and 310 deletions
Download patch file Download diff file Expand all files Collapse all files

17
nix/host-modules/hive-c0re/default.nix
View file

@ -35,26 +35,18 @@ let
gatewayCfg = config.services.hyperhive.gateway;
};
forgeGit = import ../lib/hive-forge-git.nix {
inherit pkgs;
forgeDomain = config.services.hyperhive.swarm.forge.domain;
};
# Privsep splits ownership across users, so git/libgit2's dubious-
# ownership guard trips on legitimate cross-user reads: hive-c0re
# (hive-core) fetches the agent-owned proposed-config repos. The process is
# trusted and can already read the files; this gitconfig only satisfies the
# ownership guard. libgit2 honours the literal `*` (mid-path globs aren't
# supported, so per-agent repos can't be listed); in practice this process
# only ever touches hyperhive's own repos.
#
# The forge sections (`forgeGit.config`) answer for the `git+http` forge
# fetches nix makes: the agent config inputs and `internal/meta`. hive-c0re's
# own forge reads use `forge::reader_token()` instead.
# only ever touches hyperhive's own repos. Its forge reads authenticate with
# `forge::reader_token()`, handed to git per command, so no credential helper
# is configured.
safeDirGitconfig = pkgs.writeText "hyperhive-safe-gitconfig" ''
[safe]
directory = *
${forgeGit.config}
[http]
# Abort a stalled fetch instead of blocking startup indefinitely. If a
# git http transfer from the forge (e.g. filling an applied mirror)
@ -251,9 +243,6 @@ in
after = [ "hive-c0re.socket" ];
path = [
pkgs.git
# `git-credential-hive-forge` on PATH so git finds it for git+http
# fetches from the forge (helper = hive-forge).
forgeGit.credentialHelper
"/run/current-system/sw"
];
environment = import ./environment.nix { inherit lib config pkgs; };

4
nix/host-modules/hive-c0re/environment.nix
View file

@ -47,8 +47,8 @@ in
HOME = "/var/lib/hyperhive";
HYPERHIVE_GIT = "${pkgs.git}/bin/git";
# Never let git block on an interactive credential prompt. hive-core is a
# TTY-less system user, so a prompt (e.g. the forge credential helper
# returns nothing because the forge isn't reachable yet on cold boot)
# TTY-less system user, so a prompt (e.g. git asking for credentials
# because the forge isn't reachable yet on cold boot)
# would hang forever and freeze the daemon during startup. With this set,
# git fails fast instead of prompting. Paired with the git http
# low-speed abort in `safeDirGitconfig` (bounds a stalled transfer) and