vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: render, lock and commit internal/meta

Browse source 
A new update_meta node renders internal/meta's flake.nix with
hive-meta-flake, the renderer hive-c0re uses: hyperhive pinned to its
forge main, each custom agent a hive places pinned to its agent-configs
main, all over https, and the swarm-wide values from
SWARM_CONTROLLER_META_FLAKE (set by swarm-controller.nix from
services.hyperhive.swarm.*). The swarm builder locks it, and the
controller commits flake.nix and flake.lock in one commit and gives
every hive's forge account read on the repo. A render equal to the
committed flake.nix sends no lock and commits nothing.

It runs at start, when hyperhive's main moves, before the deploy of a
merged config PR and before the first deploy of a new agent; those
deploys now wait for it. agent_web_port moves into hive-meta-flake so
both callers compute the same port; hive-c0re re-exports it.

On deploy: internal/meta appears on the forge and follows every merge.
No hive builds from it yet.

Refs #4857
This commit is contained in:
atlas 2026-10-22 07:52:23 +02:00
commit 5950363a10
16 changed files with 970 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

40
nix/host-modules/swarm-controller.nix
View file

@ -252,6 +252,43 @@ let
SWARM_CONTROLLER_MATRIX_HOMESERVER_URL = deployCfg.swarm-controller.matrixHomeserverUrl;
};
# What `internal/meta` renders into every agent's build
# (swarm-controller/src/meta_flake.rs `Settings`): the names and values
# ./hive-c0re/environment.nix forwards, minus the per-host ones. One flake
# serves every hive, so a host's own answer here would reach all of them.
# `HIVE_AGENT_NATS_URL` is per host and reaches the container through the
# hive facts instead.
#
# The store-backed values are gated on this controller's store identity,
# where a hive gates them on its own: the swarm has a store when its
# controller can reach one.
metaEnv = {
SWARM_CONTROLLER_META_FLAKE = builtins.toJSON {
vars = {
HIVE_FORGE_URL = "http://${forgeCfg.domain}";
}
// lib.optionalAttrs (forgeCfg.publicUrl != null) {
HIVE_FORGE_PUBLIC_URL = forgeCfg.publicUrl;
}
// lib.optionalAttrs (matrixCfg.gatewayHost != null) {
HIVE_MATRIX_URL = "http://${matrixCfg.gatewayHost}";
}
// lib.optionalAttrs (swarmCfg.name != null) {
HYPERHIVE_SWARM_NAME = swarmCfg.name;
}
// lib.optionalAttrs haveBaoIdentity {
HIVE_AGENT_LOGS_QUERY_URL = "https://${swarmCfg.victorialogs.domain}/select/logsql/query";
HIVE_AGENT_METRICS_URL = "https://${swarmCfg.victoriametrics.domain}";
HIVE_AGENT_BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
HIVE_AGENT_BAO_SERVICES_PKI_MOUNT = deployCfg.bao.servicesPkiMountPath;
};
# Where the pinned inputs are fetched from: the builder's credential
# helper answers only `https` for the forge.
git_base = "https://${forgeCfg.domain}";
github_disabled = !swarmCfg.github.enable;
};
};
# The swarm's own display name, for `GET /api/swarm` (swarm-ui's chrome).
# Gated on the option resolving, not defaulted to an empty string: an
# operator who never named the swarm gets `name: null` from the
@ -831,7 +868,8 @@ in
// authBridgeEnv
// swarmNameEnv
// matrixHomeserverEnv
// baoEnv;
// baoEnv
// metaEnv;
};
};
}