vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

build agents from internal/meta when it pins their config

Browse source 
A rebuild's MetaSync resolves the head of the swarm's internal/meta once and
records it; the prebuild and the swap build that flake instead of the hive's
own, and a first deploy does the same in Create. hive-priv takes the commit as
a validated meta_rev on UpdateContainer and CreateContainer and builds from its
own forge URL (HIVE_PRIV_FORGE_URL).

The head is used only when its flake lists the agent at the config commit the
forge's main is at; otherwise, and when the repo has no commit or this hive has
no core token file for nix's git, the hive renders locally as before.

hive-c0re's and hive-priv's gitconfig now share the forge credential helper and
rewrite the forge's https URLs to http, which hive-priv lacked.
This commit is contained in:
atlas 2026-10-24 14:59:43 +02:00
commit 7c0a622d41
19 changed files with 831 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/host-modules/hive-priv.nix
View file

@ -10,12 +10,20 @@
let
cfg = config.services.hyperhive.c0re;
# Same safe.directory gitconfig as the c0re unit (see ./hive-c0re)
# — hive-priv (root) runs nix, which fetches the hive-core-owned
# meta/applied repos; libgit2 refuses cross-user reads without it.
forgeGit = import ./lib/hive-forge-git.nix {
inherit pkgs;
forgeDomain = config.services.hyperhive.swarm.forge.domain;
};
# Same gitconfig as the c0re unit (see ./hive-c0re) apart from its stalled-
# transfer limit: hive-priv (root) runs nix, which fetches the hive-core-owned
# meta/applied repos (libgit2 refuses cross-user reads without
# safe.directory) and, from a fresh HOME, the forge inputs of `internal/meta`
# (the forge sections).
safeDirGitconfig = pkgs.writeText "hyperhive-safe-gitconfig" ''
[safe]
directory = *
${forgeGit.config}
'';
in
{
@ -82,6 +90,7 @@ in
pkgs.nixos-container
pkgs.nix # nix, nix-env, nix-instantiate — create + update
pkgs.gitMinimal # git — nix fetches/re-resolves git-source flake inputs
forgeGit.credentialHelper # git-credential-hive-forge — the forge's `git+http` inputs
pkgs.openssh # ssh — nix dispatches builds to remote builders
pkgs.util-linux # umount (nsenter is hardcoded in the script)
pkgs.e2fsprogs # chattr
@ -100,6 +109,9 @@ in
# routing so nixos-container update and the nix prebuild see the
# same store and substituters as every other build context.
NIX_REMOTE = "daemon";
# The forge origin `internal/meta` is built from when a request names
# one of its commits. Fixed here; no request chooses it.
HIVE_PRIV_FORGE_URL = "http://${config.services.hyperhive.swarm.forge.domain}";
};
serviceConfig = {
ExecStart = "${cfg.package}/bin/hive-priv";