vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

docs/integrations, hive-c0re nix: the agent config input is the local applied mirror

Browse source 
forge.md said the meta flake fetches agent-configs over git+http through a
credential helper. The input is git+file://<applied> (meta.rs), and
hive-c0re's own git reads use forge::reader_token(). Fix the same claim in
the comments above the hive-c0re gitconfig and the credential helper. No
code change.
This commit is contained in:
atlas 2026-10-09 22:38:53 +02:00 • committed by mara
commit 66c1a564a4
2 changed files with 17 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/host-modules/hive-c0re/default.nix
View file

@ -43,12 +43,11 @@ let
# (mid-path globs aren't supported, so per-agent repos can't be listed);
# in practice these processes only ever touch hyperhive's own repos.
#
# The agent config inputs now live on the forge
# (`git+http://${forge.domain}/agent-configs/<n>.git`, see meta.rs render),
# so hive-core's `nix flake update` of those inputs is an authenticated
# `git+http` fetch. The `[credential]` stanza points git at the `hive-forge`
# helper below (scoped to the forge host) so the fetch authenticates as the
# forge `core` user with no token in any URL or lock.
# The agent config inputs are local `git+file` mirrors of the applied repos
# (meta.rs render), so the meta flake fetches nothing from the forge. The
# `[credential]` stanza points git at the `hive-forge` helper below, scoped
# to the forge host, for any `git+http` fetch from it as the forge `core`
# user. hive-c0re's own forge reads use `forge::reader_token()` instead.
safeDirGitconfig = pkgs.writeText "hyperhive-safe-gitconfig" ''
[safe]
directory = *
@ -66,12 +65,13 @@ let
lowSpeedTime = 30
'';
# git credential helper for hive-core's authenticated fetches of the
# agent-config repos on the forge. Reads the live forge-core admin token
# git credential helper answering for the forge host as `core`. Reads the
# live forge-core admin token
# (`/var/lib/hyperhive/forge-core-token` — paths.rs `FORGE_CORE_TOKEN`) on
# every invocation, so it never holds a stale copy and survives token
# rotation. Scoped to the forge host by the `[credential]` stanza above;
# implements the git credential-helper protocol (only `get` answers).
# rotation; prints nothing where that file is absent. Scoped to the forge
# host by the `[credential]` stanza above; implements the git
# credential-helper protocol (only `get` answers).
forgeCredHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
[ "''${1:-}" = "get" ] || exit 0
if [ -r /var/lib/hyperhive/forge-core-token ]; then