vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: allSwarmServices turns on the review classifier

Browse source 
deploy.review-classifier.enable now defaults to allSwarmServices, as the
other shared services do, but only where the host has the classifier's
store identity (deploy.bao.reviewClassifierClient{Cert,Key}File). The
classifier module asserts that pair; glue-bao-tls.nix mints it only on the
host that runs the store, so a services host with the store placed
elsewhere would otherwise fail eval. An explicit value still wins.

The operator still writes the Anthropic key by hand; until then each run
fails with "no API key…" while the service runs.
This commit is contained in:
atlas 2026-10-12 10:48:32 +02:00 • committed by mara
commit 34bde7a5af
5 changed files with 67 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/host-modules/deploy.nix
View file

@ -653,9 +653,13 @@ in
`secret/swarm/services/review-classifier/anthropic-api-key`, field
`api_key`.
Not derived from
{option}`services.hyperhive.deploy.allSwarmServices`: every run spends
money on that key, so running one is a decision of its own.
On by default where
{option}`services.hyperhive.deploy.allSwarmServices` is set and this
host has the classifier's store identity (the pair
{option}`services.hyperhive.deploy.bao.reviewClassifierClientCertFile`
and `reviewClassifierClientKeyFile`, minted on the store's host). The
key is never written for you: until the operator writes it the service
runs and every run fails with "no API key…".
'';
};

12
nix/host-modules/swarm-required-services.nix
View file

@ -105,4 +105,16 @@ in
# `singleHostSwarm` box, which gets here through `allSwarmServices`, would
# have no forge at all.
config.services.hyperhive.deploy.forgejo.enable = lib.mkDefault deployCfg.allSwarmServices;
# The review classifier. Its module asserts a store identity, which
# glue-bao-tls.nix mints only on the host that runs the store; with the store
# placed elsewhere both files stay null and an unconditional `true` here would
# fail that host's eval. So the default follows the identity, and a host
# holding a copy of the pair (`deploy.bao.reviewClassifierClient{Cert,Key}File`)
# gets the classifier too.
config.services.hyperhive.deploy.review-classifier.enable = lib.mkDefault (
deployCfg.allSwarmServices
&& deployCfg.bao.reviewClassifierClientCertFile != null
&& deployCfg.bao.reviewClassifierClientKeyFile != null
);
}

5
nix/host-modules/swarm-review-classifier.nix
View file

@ -1,6 +1,7 @@
# The review classifier, in a `swarm-review-classifier` container on the host
# that sets `deploy.review-classifier.enable`. It answers the swarm UI's review
# try-outs: swarm-controller sends a PR and the operator's classifications over
# that sets `deploy.review-classifier.enable`, which `deploy.allSwarmServices`
# defaults on where the host has the classifier's store identity. It answers the
# swarm UI's review try-outs: swarm-controller sends a PR and the operator's classifications over
# the queue, and the daemon runs `claude` once per classification and replies.
# docs/swarm/review-classifier.md has the design.
#