vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the hive-c0re forge-credential chain nothing reads any more

Browse source 
With no nix build on the hive, the boot publish of the forge token for nix has no reader. Removes the ForgeSweep node, the token file, the git credential helper and hive-c0re's forge gitconfig sections.
This commit is contained in:
atlas 2026-10-29 22:55:31 +01:00
commit 221c3f35a1
1 changed files with 69 additions and 310 deletions
Download patch file Download diff file Expand all files Collapse all files

40
nix/module-eval/core-toggle.nix
View file

@ -234,39 +234,25 @@ let
&& env shared.controllerAlone == { };
}
{
# hive-c0re carries the credential helper and the https-to-http rewrite as
# git config. hive-priv builds nothing and fetches nothing from the forge,
# so it carries neither and has no forge URL. The hive-c0re arm is the
# control that the lookups find a helper and a forge URL where there is
# one, so the absences on hive-priv and the controller are real.
name = "hive-c0re answers the forge's git fetches and rewrites its https inputs to http; hive-priv has neither";
# No host process hands nix a forge URL any more, so none carries a git
# credential helper for the forge. The hive-c0re arm is the control: its
# `git` and its forge URL are found by the same lookups, so the absences
# are real.
name = "no host unit carries the forge credential helper, and hive-priv has no forge URL";
ok =
let
forge = allLocal.services.hyperhive.swarm.forge.domain;
git = import ../host-modules/lib/hive-forge-git.nix {
inherit pkgs;
forgeDomain = forge;
};
helperOn =
pathNames =
unit:
lib.any (
p: builtins.isAttrs p && (p.name or "") == "git-credential-hive-forge"
) allLocal.systemd.services.${unit}.path;
map (p: if builtins.isAttrs p then p.name or "" else "") allLocal.systemd.services.${unit}.path;
env = unit: allLocal.systemd.services.${unit}.environment;
in
helperOn "hive-c0re"
&& !(helperOn "hive-priv")
# The helper answers from the file hive-c0re publishes the hive's own
# token to. The first arm is the control for the second: the lookup
# finds the helper's text, so the absent `core` strings are really absent.
&& lib.hasInfix "/run/hyperhive/forge-hive-token" git.credentialHelper.text
&& !(lib.hasInfix "forge-core-token" git.credentialHelper.text)
&& !(lib.hasInfix "username=core" git.credentialHelper.text)
&& !(lib.hasInfix "username = core" git.config)
&& !(helperOn "swarm-controller")
&& lib.hasInfix "[credential \"http://${forge}\"]\nhelper =\nhelper = hive-forge" git.config
&& lib.hasInfix "[url \"http://${forge}/\"]\ninsteadOf = https://${forge}/" git.config
lib.any (lib.hasPrefix "git-2") (pathNames "hive-c0re")
&& (env "hive-c0re") ? HIVE_FORGE_URL
&& lib.all (unit: !(builtins.elem "git-credential-hive-forge" (pathNames unit))) [
"hive-c0re"
"hive-priv"
"swarm-controller"
]
&& !((env "hive-priv") ? HIVE_PRIV_FORGE_URL);
}
{