vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

remove hive-level infra-container restart from web ui and agents

Browse source
This commit is contained in:
damocles 2026-08-30 22:12:04 +02:00 • committed by mara
commit 7516a4e10e
17 changed files with 112 additions and 272 deletions
Download patch file Download diff file Expand all files Collapse all files

42
hive-priv-sock/src/lib.rs
View file

@ -56,7 +56,6 @@ pub const SIBLING_CONTAINERS: &[&str] = &["hive-forge", "hive-matrix", "hive-ci"
pub enum InfraAction {
Start,
Stop,
Restart,
}
impl InfraAction {
@ -66,7 +65,6 @@ impl InfraAction {
match self {
InfraAction::Start => "start",
InfraAction::Stop => "stop",
InfraAction::Restart => "restart",
}
}
}
@ -150,28 +148,13 @@ impl InfraContainer {
InfraTarget::HostUnit(unit) => unit.to_owned(),
}
}
/// Whether an agent holding `infra_admin` may restart this target.
///
/// The gateway is excluded by operator ruling: nginx now fronts every
/// hive service from the host, so an agent restarting it can take the
/// forge, dashboard and matrix down with it — including the path its
/// own PR would have to travel to fix it. The operator surface
/// (`hivectl`, dashboard) is unaffected.
#[must_use]
pub fn agent_restartable(self) -> bool {
!matches!(self, InfraContainer::Gateway)
}
}
impl std::str::FromStr for InfraContainer {
type Err = ();
/// Parse an infra name (`hive-ci`, …) into a variant. Recognition
/// only — it says the name denotes a hive service, *not* that the
/// caller may act on it. The agent restart path additionally checks
/// [`agent_restartable`](InfraContainer::agent_restartable).
/// `Err(())` for anything that isn't one.
/// Parse an infra name (`hive-ci`, …) into a variant. `Err(())` for
/// anything that isn't one.
fn from_str(s: &str) -> Result<Self, ()> {
Self::ALL.into_iter().find(|c| c.name() == s).ok_or(())
}
@ -601,13 +584,13 @@ pub enum PrivRequest {
token: String,
},
/// Start / stop / restart a hive infrastructure container on the host
/// via `systemctl <action> container@<container>.service`. The
/// Start / stop a hive infrastructure container on the host via
/// `systemctl <action> container@<container>.service`. The
/// [`InfraContainer`] enum is the allowlist — serde rejects unknown /
/// unsafe names (notably `hive-c0re`, which has no variant) at the wire
/// boundary, so no root-side `.contains()` check is needed. Serves both
/// the hive-wide `hivectl stop` / `hivectl start` flow and an
/// `infra_admin` agent's `restart` (with `action = Restart`).
/// boundary, so no root-side `.contains()` check is needed. Serves the
/// hive-wide `hivectl stop` / `hivectl start` flow and the dashboard's
/// operator-only infra panel. No agent-facing path exists.
ControlInfraContainer {
container: InfraContainer,
action: InfraAction,
@ -956,15 +939,4 @@ mod tests {
);
assert_eq!(InfraContainer::Gateway.service_unit(), "nginx.service");
}
#[test]
fn only_the_gateway_is_off_limits_to_agents() {
// Recognising a name and being allowed to restart it are separate
// questions — the gateway parses fine and is still refused.
assert!("hive-gateway".parse::<InfraContainer>().is_ok());
assert!(!InfraContainer::Gateway.agent_restartable());
for c in InfraContainer::ALL {
assert_eq!(c.agent_restartable(), c != InfraContainer::Gateway, "{c:?}");
}
}
}