vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

build agents from internal/meta when it pins their config

Browse source 
A rebuild's MetaSync resolves the head of the swarm's internal/meta once and
records it; the prebuild and the swap build that flake instead of the hive's
own, and a first deploy does the same in Create. hive-priv takes the commit as
a validated meta_rev on UpdateContainer and CreateContainer and builds from its
own forge URL (HIVE_PRIV_FORGE_URL).

The head is used only when its flake lists the agent at the config commit the
forge's main is at; otherwise, and when the repo has no commit or this hive has
no core token file for nix's git, the hive renders locally as before.

hive-c0re's and hive-priv's gitconfig now share the forge credential helper and
rewrite the forge's https URLs to http, which hive-priv lacked.
This commit is contained in:
atlas 2026-10-24 14:59:43 +02:00
commit 7c0a622d41
19 changed files with 831 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

41
nix/host-modules/hive-c0re/default.nix
View file

@ -35,6 +35,11 @@ let
gatewayCfg = config.services.hyperhive.gateway;
};
forgeGit = import ../lib/hive-forge-git.nix {
inherit pkgs;
forgeDomain = config.services.hyperhive.swarm.forge.domain;
};
# Privsep splits ownership across users, so git/libgit2's dubious-
# ownership guard trips on legitimate cross-user reads: hive-priv (root)
# fetches the hive-core-owned meta/applied repos via nix, and hive-c0re
@ -44,24 +49,13 @@ let
# (mid-path globs aren't supported, so per-agent repos can't be listed);
# in practice these processes only ever touch hyperhive's own repos.
#
# The agent config inputs are `git+http` forge URLs pinned by sha (meta.rs
# render). The `[credential]` stanza points git at the `hive-forge` helper
# below, scoped to the forge host, for any `git+http` fetch from it as the
# forge `core` user. hive-c0re's own forge reads use `forge::reader_token()` instead.
#
# git runs every matching `credential.helper`, system config first, so a
# host helper (e.g. `oauth`, which waits on a browser) would run ahead of
# ours. An empty `helper =` resets the list; it comes first at both the
# global and the forge level so no /etc/gitconfig helper survives.
# The forge sections (`forgeGit.config`) answer for the `git+http` forge
# fetches nix makes: the agent config inputs and `internal/meta`. hive-c0re's
# own forge reads use `forge::reader_token()` instead.
safeDirGitconfig = pkgs.writeText "hyperhive-safe-gitconfig" ''
[safe]
directory = *
[credential]
helper =
[credential "http://${config.services.hyperhive.swarm.forge.domain}"]
helper =
helper = hive-forge
username = core
${forgeGit.config}
[http]
# Abort a stalled fetch instead of blocking startup indefinitely. If a
# git http transfer from the forge (e.g. filling an applied mirror)
@ -73,21 +67,6 @@ let
lowSpeedTime = 30
'';
# git credential helper answering for the forge host as `core`. Reads the
# live forge-core admin token
# (`/var/lib/hyperhive/forge-core-token` — paths.rs `FORGE_CORE_TOKEN`) on
# every invocation, so it never holds a stale copy and survives token
# rotation; prints nothing where that file is absent. Scoped to the forge
# host by the `[credential]` stanza above; implements the git
# credential-helper protocol (only `get` answers).
forgeCredHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
[ "''${1:-}" = "get" ] || exit 0
if [ -r /var/lib/hyperhive/forge-core-token ]; then
printf 'username=core\n'
printf 'password=%s\n' "$(cat /var/lib/hyperhive/forge-core-token)"
fi
'';
# The `hive-c0re serve` config JSON. Keys are snake_case to match the
# `ServeConfig` serde shape the daemon deserialises (the
# container-injected HiveEnv fields, flattened, plus the hive-c0re-local
@ -276,7 +255,7 @@ in
pkgs.git
# `git-credential-hive-forge` on PATH so git finds it for git+http
# fetches from the forge (helper = hive-forge).
forgeCredHelper
forgeGit.credentialHelper
"/run/current-system/sw"
];
environment = import ./environment.nix { inherit lib config pkgs; };