vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(#1906): non-root weston gui on a fixed vnc port

Browse source
This commit is contained in:
damocles 2026-06-23 22:26:08 +02:00 • committed by mara
commit 3d2e0ef561
5 changed files with 127 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

20
hive-ag3nt/src/web_ui.rs
View file

@ -57,8 +57,8 @@ struct AppState {
files: TurnFiles,
/// Prevents `/api/compact` from racing with an in-flight normal turn.
turn_lock: TurnLock,
/// VNC port read from `/etc/hyperhive/gui.json` at startup.
/// `None` when the file is absent (gui not enabled for this agent).
/// VNC port from the `HIVE_GUI_VNC_PORT` env var at startup.
/// `None` when unset (gui not enabled for this agent).
gui_vnc_port: Option<u16>,
}
@ -83,7 +83,7 @@ pub async fn serve(
files: TurnFiles,
turn_lock: TurnLock,
) -> Result<()> {
let gui_vnc_port = read_gui_json();
let gui_vnc_port = read_gui_vnc_port();
let static_dir: PathBuf = std::env::var_os("HIVE_STATIC_DIR")
.map(PathBuf::from)
.context(
@ -277,12 +277,14 @@ async fn serve_icon() -> impl IntoResponse {
([("content-type", "image/svg+xml")], body)
}
/// Read `/etc/hyperhive/gui.json` and extract the `vnc_port` field.
/// Returns `None` if the file is absent or unparseable — GUI not enabled.
fn read_gui_json() -> Option<u16> {
let text = std::fs::read_to_string("/etc/hyperhive/gui.json").ok()?;
let val: serde_json::Value = serde_json::from_str(&text).ok()?;
val["vnc_port"].as_u64().and_then(|p| u16::try_from(p).ok())
/// The fixed VNC port weston bound, from the `HIVE_GUI_VNC_PORT` env var
/// the harness service sets when gui is enabled (see weston-vnc.nix).
/// `None` when unset (gui not enabled for this agent) or unparseable.
/// The port is a fixed, container-local value — no per-agent hashing, no
/// marker file — because network isolation is unconditional (each agent
/// has its own netns, so the port can't collide across containers).
fn read_gui_vnc_port() -> Option<u16> {
std::env::var("HIVE_GUI_VNC_PORT").ok()?.parse().ok()
}
/// WebSocket handler: upgrade then pump bytes between the WS client and