vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

let the operator set, replace and remove an agent's backend env from the swarm ui

Browse source
This commit is contained in:
atlas 2026-10-28 01:33:52 +01:00 • committed by mara
commit 57b04d6c49
2 changed files with 795 additions and 201 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/host-modules/swarm-bao.nix
View file

@ -474,6 +474,10 @@ let
capabilities = ["delete"]
}
path "${credentialMountPath}/metadata/swarm/agents/+/backend-env" {
capabilities = ["delete"]
}
path "${credentialMountPath}/data/swarm/hives/+/matrix/sender-token" {
capabilities = ["create", "read", "update"]
}

10
nix/module-eval/bao-grants.nix
View file

@ -2265,11 +2265,12 @@ let
in
lib.hasInfix "path \"secret/metadata/swarm/agents/+/matrix/\" {\n capabilities = [\"list\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/forge/\" {\n capabilities = [\"list\"]\n}" s
&& stanzas == 6;
&& stanzas == 7;
}
{
# `linked_accounts` deletes one matrix account, forge account or GitHub
# token through `delete_all_versions`, which addresses its metadata path.
# `linked_accounts` deletes one matrix account, forge account, GitHub
# token or backend environment through `delete_all_versions`, which
# addresses its metadata path.
# A trailing `+` is one segment, so each stanza reaches the accounts
# directly in that directory and nothing deeper. Pinned as whole stanzas,
# so `list` or `read` here, which would expose version history, fails.
@ -2280,7 +2281,8 @@ let
in
lib.hasInfix "path \"secret/metadata/swarm/agents/+/matrix/+\" {\n capabilities = [\"delete\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/forge/+\" {\n capabilities = [\"delete\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/github-token\" {\n capabilities = [\"delete\"]\n}" s;
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/github-token\" {\n capabilities = [\"delete\"]\n}" s
&& lib.hasInfix "path \"secret/metadata/swarm/agents/+/backend-env\" {\n capabilities = [\"delete\"]\n}" s;
}
{
# The swarm appservice token is a homeserver-admin credential. The