vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(#589): swarm peers option + HYPERHIVE_PEERS env wire v0

Browse source 
nix: services.hyperhive.peers attrset-of-submodules option; serialises
to HYPERHIVE_PEERS JSON ([{label,domain}]); forwarded to containers via
FORWARDED_VARS. dashboard.rs: peer_hives: Vec<PeerHiveView> in
StateSnapshot, derived as {name:label, url:"http://domain/"}.
identity.rs: PeerHive struct + peers() accessor for agent-side use.
This commit is contained in:
damocles 2026-05-31 22:48:14 +02:00 • committed by mara
commit 348fb3792a
4 changed files with 121 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

55
nix/modules/hive-c0re.nix
View file

@ -92,6 +92,51 @@ in
'';
};
# Peer hives in the same swarm. Each entry declares a remote hive
# reachable from this host. Serialised to JSON and injected as
# `HYPERHIVE_PEERS` into the hive-c0re service and forwarded to agent
# containers via `meta.rs::FORWARDED_VARS`. Consumed by
# `identity.rs::peers()` + the dashboard's `peer_hives` state field
# (feeds iris's P33RS tab). See #589.
options.services.hyperhive.peers = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule {
options = {
domain = lib.mkOption {
type = lib.types.str;
example = "lab.example.com";
description = ''
DNS domain of the peer hive. Used to construct the peer's
dashboard URL (`http://''${domain}/`) and for Matrix
federation auto-discovery (`matrix.''${domain}`).
Must be reachable from this host.
'';
};
tlsCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
Optional path to a PEM cert/bundle to trust for this peer's
TLS. Null = system CA bundle (for Let's Encrypt peers). Set
to the peer's self-signed cert for `selfSignedTls = true`
peers. See #594.
'';
};
};
});
default = { };
example = {
lab = { domain = "lab.example.com"; };
edge = { domain = "edge.corp"; };
};
description = ''
Peer hives in the same swarm. The attrset key is a short label
used in dashboard links and log messages -- it does not need to
match the remote hive's `hiveName`. Null `tlsCertFile` uses the
system CA bundle; set it for self-signed TLS peers (#594 slot,
unimplemented in v0).
'';
};
options.services.hyperhive.c0re = {
enable = lib.mkOption {
type = lib.types.bool;
@ -309,6 +354,16 @@ in
# wrong). Absent when `behindGateway = false` — dashboard
# falls back to `<hostname>:3000`.
HIVE_FORGE_PUBLIC_URL = "https://${config.services.hyperhive.forge.domain}";
}
// lib.optionalAttrs (config.services.hyperhive.peers != { }) {
# Peer hives serialised as a JSON array of {label, domain} objects.
# Consumed by hive-ag3nt::identity::peers() + the dashboard's
# peer_hives StateSnapshot field (P33RS tab). tlsCertFile is
# nix-side-only (host nginx/trust config); rust never needs the path.
HYPERHIVE_PEERS = builtins.toJSON (
lib.mapAttrsToList (label: p: { inherit label; inherit (p) domain; })
config.services.hyperhive.peers
);
};
serviceConfig = {
ExecStart = "${cfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --hyperhive-flake ${cfg.hyperhiveFlake} --dashboard-port ${toString cfg.dashboardPort} --operator-pronouns ${lib.escapeShellArg cfg.operatorPronouns} --context-window-tokens ${lib.escapeShellArg (builtins.toJSON cfg.contextWindowTokens)}";