vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: allSwarmServices turns on the review classifier

Browse source 
deploy.review-classifier.enable now defaults to allSwarmServices, as the
other shared services do, but only where the host has the classifier's
store identity (deploy.bao.reviewClassifierClient{Cert,Key}File). The
classifier module asserts that pair; glue-bao-tls.nix mints it only on the
host that runs the store, so a services host with the store placed
elsewhere would otherwise fail eval. An explicit value still wins.

The operator still writes the Anthropic key by hand; until then each run
fails with "no API key…" while the service runs.
This commit is contained in:
atlas 2026-10-12 10:48:32 +02:00 • committed by mara
commit 34bde7a5af
5 changed files with 67 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/swarm/services.md
View file

@ -236,17 +236,18 @@ the container and the threat model are in
### Review classifier
The review classifier's try-out service, in a `swarm-review-classifier`
container on the host that sets `deploy.review-classifier.enable`. It doesn't
derive from `allSwarmServices`: every run spends money on an Anthropic API
key, so running one is a decision of its own.
container on the host that sets `deploy.review-classifier.enable`.
`allSwarmServices` defaults it on wherever the host has the classifier's store
identity: the host that runs the store has it, and a services host with the
store elsewhere gets the classifier only once it holds a copy of the pair (see
below). Set `deploy.review-classifier.enable` directly to override either way.
Two steps turn it on:
1. Write the key in the secret store's UI at
`secret/swarm/services/review-classifier/anthropic-api-key`, field
`api_key`. The service reads it on every run, so writing or removing it
takes effect on the next run, with no restart.
2. Set `services.hyperhive.deploy.review-classifier.enable = true` on a host.
The operator writes the Anthropic key by hand, in the secret store's UI at
`secret/swarm/services/review-classifier/anthropic-api-key`, field `api_key`.
Nothing writes it for you: until it exists the service runs and every run fails
with `no API key…`. The service reads the key on every run, so writing or
removing it takes effect on the next run, with no restart. Every run spends
money on that key.
It needs neither the forge nor a hive on its host. It reaches the queue and the
secret store by name, under its own `review-classifier` leaf. On a host