From 2777453c17a8108d139c102b47de03e28ce98b74 Mon Sep 17 00:00:00 2001 From: atlas Date: Tue, 20 Oct 2026 00:01:56 +0200 Subject: [PATCH] hive-core's git ignores the host's credential helpers, so a meta fetch never waits on an interactive one hive-core's .gitconfig now resets credential.helper (globally and for the forge URL) before adding hive-forge. git runs every matching helper, system config first, so a host-level `oauth` helper blocked `nix flake update`'s git ls-remote of agent-configs forever. On deploy: the boot sweep's meta_lock completes and rebuilds run. --- nix/host-modules/hive-c0re/default.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/nix/host-modules/hive-c0re/default.nix b/nix/host-modules/hive-c0re/default.nix index 056cdb92..557b497b 100644 --- a/nix/host-modules/hive-c0re/default.nix +++ b/nix/host-modules/hive-c0re/default.nix @@ -48,10 +48,18 @@ let # render). The `[credential]` stanza points git at the `hive-forge` helper # below, scoped to the forge host, for any `git+http` fetch from it as the # forge `core` user. hive-c0re's own forge reads use `forge::reader_token()` instead. + # + # git runs every matching `credential.helper`, system config first, so a + # host helper (e.g. `oauth`, which waits on a browser) would run ahead of + # ours. An empty `helper =` resets the list; it comes first at both the + # global and the forge level so no /etc/gitconfig helper survives. safeDirGitconfig = pkgs.writeText "hyperhive-safe-gitconfig" '' [safe] directory = * + [credential] + helper = [credential "http://${config.services.hyperhive.swarm.forge.domain}"] + helper = helper = hive-forge username = core [http]