drop the hive-side matrix code: sweep, hivectl matrix and the apiUrl option
This commit is contained in:
damocles
mara
parent
a00bcb8c05
commit
6dbb18b6d4
4 changed files with 49 additions and 1007 deletions
|
|
@ -109,16 +109,7 @@ On a hive that already has a ruth container from an earlier release, create
|
|||
her once the same way, so that her config repo and store identity exist. The
|
||||
container keeps starting with the hive meanwhile.
|
||||
|
||||
## 5 · Matrix
|
||||
|
||||
Your matrix account comes from SSO. Invite it to the rooms you want it in:
|
||||
|
||||
```bash
|
||||
hivectl matrix invite mara --room '#some-room:yourserver'
|
||||
hivectl matrix invite @mara:yourserver --room '!abc:yourserver'
|
||||
```
|
||||
|
||||
## 6 · Your first agent
|
||||
## 5 · Your first agent
|
||||
|
||||
Create it from the swarm UI, or:
|
||||
|
||||
|
|
|
|||
|
|
@ -96,11 +96,8 @@ and federation peers all reach the homeserver at `chat.<swarm-domain>`
|
|||
through the gateway; from outside the host that takes
|
||||
`gateway.openFirewall`.
|
||||
|
||||
hive-c0re talks to matrix (its own sender login, invites) through `swarm.matrix.apiUrl`, which defaults to
|
||||
`https://<swarm.matrix.gatewayHost>` on every hive. That login carries
|
||||
the hive's matrix access token, and on a hive that doesn't run the
|
||||
homeserver it crosses the network, so the default is TLS; hive-c0re
|
||||
verifies the gateway's certificate against the hive trust bundle.
|
||||
hive-c0re does not talk to the homeserver: matrix is swarm-level, and
|
||||
the hive has no matrix API URL to set.
|
||||
|
||||
Federation peers find the homeserver through `.well-known/matrix/server`
|
||||
at the server name, which names `<gatewayHost>:443`
|
||||
|
|
@ -143,8 +140,8 @@ a token.
|
|||
reads only `.yaml`/`.yml` entries from there, so the sibling
|
||||
credentials are invisible to it. The `.yaml` suffix on the credential
|
||||
id is what makes this work.
|
||||
4. **hive-c0re** holds no appservice token and creates no account. Its
|
||||
`@hive-<hive>:` token comes from the swarm store (below).
|
||||
4. **hive-c0re** holds no appservice token, creates no account and does
|
||||
not talk to matrix.
|
||||
5. **`swarm-controller` creates every account**: each agent's, with its
|
||||
token stored at `swarm/agents/<agent>/matrix/main` for the agent's
|
||||
`hive-matrix-daemon` to read as the agent itself, and each hive's
|
||||
|
|
@ -246,21 +243,14 @@ whose hives share a homeserver gives each of them its own identity: the
|
|||
homeserver attributes an action to the hive that took it, and revoking one
|
||||
hive's standing leaves the others alone.
|
||||
|
||||
Its access token is the **sender token**, and it's the credential
|
||||
hive-c0re presents for every homeserver call it makes on the hive's
|
||||
behalf. It's per hive for the same reason the account is:
|
||||
`swarm-controller`, its only minter, mints it for every hive with the swarm's
|
||||
appservice token and publishes it to `swarm/hives/<hive>/matrix/sender-token`, and the hive
|
||||
reads it from there under its own certificate. That path sits inside the
|
||||
hive's own read grant (`swarm/hives/<hive>/*`), so a hive fetches its own
|
||||
token and gets a refusal on any other hive's. The name says what it
|
||||
authenticates as — an account the swarm's appservice creates — rather
|
||||
than any privilege level, because it carries none.
|
||||
|
||||
It needs no promotion for what the hive does with it. Inviting a user into a
|
||||
room it has the power in is an ordinary client call — there is no homeserver
|
||||
admin in any of it, and no Synapse admin API to reach for either, since
|
||||
tuwunel has none.
|
||||
Its access token is the **sender token**. `swarm-controller`, its only
|
||||
minter, mints it for every hive with the swarm's appservice token and
|
||||
publishes it to `swarm/hives/<hive>/matrix/sender-token`, inside the hive's own
|
||||
read grant (`swarm/hives/<hive>/*`). Nothing on the hive uses it any more:
|
||||
hive-c0re used to present it for its Space and invite calls and no longer
|
||||
makes any. The name says what it authenticates as — an account the
|
||||
swarm's appservice creates — rather than any privilege level, because it
|
||||
carries none.
|
||||
|
||||
Promoting a user to homeserver admin and resetting a password both need an
|
||||
admin **sender**: `!admin …` messages into `#admins:<server_name>`, and
|
||||
|
|
@ -270,17 +260,6 @@ admin. Of the swarm's own accounts only `@swarm` is a homeserver admin
|
|||
[Operators are homeserver admins](#operators-are-homeserver-admins)), so
|
||||
both are swarm-level operations.
|
||||
|
||||
<details><summary>Store precedence for a hive's sender account</summary>
|
||||
|
||||
`ensure_hive_user` reads the per-hive path
|
||||
`swarm/hives/<hive>/matrix/sender-token` **first, on every sweep**, not
|
||||
just when that file is missing (`sender_source`'s decision).
|
||||
`swarm-controller` mints a per-hive token within five minutes of a hive
|
||||
appearing; the sweep then overwrites the per-hive file, no boot
|
||||
required.
|
||||
|
||||
</details>
|
||||
|
||||
<details><summary>Appservice identity</summary>
|
||||
|
||||
`swarm-matrix-ctl appservice render` renders the registration from the
|
||||
|
|
@ -344,17 +323,14 @@ Initial rollout settings:
|
|||
stored yet the account comes up without backup and picks it up on the
|
||||
next daemon start. A failure is a `WARN` and never stops the daemon.
|
||||
|
||||
## Hive sender token
|
||||
## Retired hive-side matrix code
|
||||
|
||||
hive-c0re keeps the hive's `@hive-<hive>:` sender token on disk for
|
||||
`hivectl matrix invite`, refreshed from the swarm secret store by the
|
||||
matrix sweep (at boot, then every 30 minutes).
|
||||
|
||||
Earlier versions also created a private "hive" Matrix Space and a
|
||||
`hive-chat` room, invited every agent to both, and kept their ids in
|
||||
`/var/lib/hyperhive/matrix/space-room-id` and `chat-room-id`. The sweep no
|
||||
longer touches any of them. The rooms and files are harmless leftovers, so
|
||||
delete them by hand if you like.
|
||||
Earlier versions of hive-c0re created a private "hive" Matrix Space and a
|
||||
`hive-chat` room, invited every agent to both, kept the hive's sender token
|
||||
on disk and offered `hivectl matrix invite`. All of that is gone: matrix is
|
||||
swarm-level, so the hive no longer talks to the homeserver. The Space, the
|
||||
room and the files `/var/lib/hyperhive/matrix/{access-token,space-room-id,chat-room-id}`
|
||||
are harmless leftovers, so delete them by hand if you like.
|
||||
|
||||
## Configuration tuning
|
||||
|
||||
|
|
|
|||
|
|
@ -7,8 +7,6 @@ This document contains the help content for the `hivectl` command-line program.
|
|||
* [`hivectl`↴](#hivectl)
|
||||
* [`hivectl forge`↴](#hivectl-forge)
|
||||
* [`hivectl forge reconcile-config`↴](#hivectl-forge-reconcile-config)
|
||||
* [`hivectl matrix`↴](#hivectl-matrix)
|
||||
* [`hivectl matrix invite`↴](#hivectl-matrix-invite)
|
||||
* [`hivectl agent`↴](#hivectl-agent)
|
||||
* [`hivectl agent restart`↴](#hivectl-agent-restart)
|
||||
* [`hivectl agent pause`↴](#hivectl-agent-pause)
|
||||
|
|
@ -45,14 +43,13 @@ This document contains the help content for the `hivectl` command-line program.
|
|||
|
||||
## `hivectl`
|
||||
|
||||
Sibling to the `hive-c0re` daemon binary. Covers host-side admin operations that don't go through the broker — manual user provisioning on the bundled matrix container, plus future recovery / debugging verbs.
|
||||
Sibling to the `hive-c0re` daemon binary. Covers host-side admin operations that don't go through the broker, plus future recovery / debugging verbs.
|
||||
|
||||
**Usage:** `hivectl [OPTIONS] <COMMAND>`
|
||||
|
||||
###### **Subcommands:**
|
||||
|
||||
* `forge` — Reconcile an agent's config between this hive and the forge
|
||||
* `matrix` — matrix-tuwunel invites
|
||||
* `agent` — Lifecycle actions on ONE managed agent container. Needs the hive-c0re daemon running
|
||||
* `list-agents` — Show all managed agents with their status and technical state
|
||||
* `quota-enable` — Enable btrfs qgroup accounting on the agent-state filesystem
|
||||
|
|
@ -112,36 +109,6 @@ Always prints the diff first. `--from forge` resets the local checkout to forge
|
|||
|
||||
|
||||
|
||||
## `hivectl matrix`
|
||||
|
||||
matrix-tuwunel invites.
|
||||
|
||||
Manual invites into a room by id or alias.
|
||||
|
||||
**Usage:** `hivectl matrix <COMMAND>`
|
||||
|
||||
###### **Subcommands:**
|
||||
|
||||
* `invite` — Invite a matrix user to a room. Idempotent
|
||||
|
||||
|
||||
|
||||
## `hivectl matrix invite`
|
||||
|
||||
Invite a matrix user to a room. Idempotent
|
||||
|
||||
**Usage:** `hivectl matrix invite --room <ROOM> <USER>`
|
||||
|
||||
###### **Arguments:**
|
||||
|
||||
* `<USER>` — User to invite: a full id (`@mara:server`) or a bare localpart (qualified with the homeserver's `server_name`)
|
||||
|
||||
###### **Options:**
|
||||
|
||||
* `--room <ROOM>` — Target room id (`!abc:server`) or alias (`#name:server`)
|
||||
|
||||
|
||||
|
||||
## `hivectl agent`
|
||||
|
||||
Lifecycle actions on ONE managed agent container. Needs the hive-c0re daemon running.
|
||||
|
|
|
|||
|
|
@ -10,8 +10,8 @@ login user in `services.hyperhive.c0re.adminUsers` (adds you to the
|
|||
Available via the `hive-c0re` package in the host NixOS config.
|
||||
|
||||
Unlike the `hive-c0re` daemon subcommands (which go through the broker),
|
||||
`hivectl` covers direct host-side administration: manual provisioning of
|
||||
matrix accounts, container lifecycle shortcuts, and interactive agent shell access.
|
||||
`hivectl` covers direct host-side administration: container lifecycle
|
||||
shortcuts and interactive agent shell access.
|
||||
|
||||
This page is the curated guide. For the exhaustive flag-by-flag
|
||||
reference autogenerated from the binary's own command tree, see
|
||||
|
|
@ -42,26 +42,6 @@ hivectl forge reconcile-config iris --verbose # include the full diff, not
|
|||
supported yet (forge `main` is branch-protected; resolve via a config
|
||||
PR). With no `--from` it prompts for the direction after the diff.
|
||||
|
||||
## Matrix
|
||||
|
||||
Manual invites into a room. Requires the `hive-matrix` container to be
|
||||
running (`services.hyperhive.deploy.matrix.enable = true`).
|
||||
|
||||
```bash
|
||||
hivectl matrix invite mara --room '#some-room:server' # a room alias
|
||||
hivectl matrix invite @mara:server --room '!abc:server' # ...or a room id
|
||||
```
|
||||
|
||||
Human matrix accounts come from SSO, not `hivectl`; matrix homeserver
|
||||
admin should eventually come from membership in authelia's `admins`
|
||||
group; nobody has built that sync yet.
|
||||
|
||||
- `invite`: invites a matrix user (full `@user:server` or a bare
|
||||
localpart, qualified with the homeserver's `server_name`) to the
|
||||
`--room` id / `#alias`. Uses the sender token; the account must be a
|
||||
member of the target room with invite power.
|
||||
Idempotent — already-member / already-invited is a no-op.
|
||||
|
||||
## Agents
|
||||
|
||||
Container lifecycle shortcuts that go through the host admin socket.
|
||||
|
|
|
|||
Loading…
Reference in a new issue