vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

build agents from internal/meta when it pins their config

Browse source 
A rebuild's MetaSync resolves the head of the swarm's internal/meta once and
records it; the prebuild and the swap build that flake instead of the hive's
own, and a first deploy does the same in Create. hive-priv takes the commit as
a validated meta_rev on UpdateContainer and CreateContainer and builds from its
own forge URL (HIVE_PRIV_FORGE_URL).

The head is used only when its flake lists the agent at the config commit the
forge's main is at; otherwise, and when the repo has no commit or this hive has
no core token file for nix's git, the hive renders locally as before.

hive-c0re's and hive-priv's gitconfig now share the forge credential helper and
rewrite the forge's https URLs to http, which hive-priv lacked.
This commit is contained in:
atlas 2026-10-24 14:59:43 +02:00
commit 7c0a622d41
19 changed files with 831 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

43
nix/module-eval/core-toggle.nix
View file

@ -215,6 +215,49 @@ let
}
&& env shared.controllerAlone == { };
}
{
# nix fetches the forge inputs with `git`, so the credential helper and
# the https-to-http rewrite are git config in both processes that build:
# hive-c0re (prebuilds) and hive-priv (builds as root, from its own
# HOME). The controller's unit is the control that the lookup tells a
# unit with the helper from one without; the URL hive-priv builds
# `internal/meta` from is the one hive-c0re reads the forge at.
name = "hive-c0re and hive-priv answer the forge's git fetches and rewrite its https inputs to http";
ok =
let
forge = allLocal.services.hyperhive.swarm.forge.domain;
git = import ../host-modules/lib/hive-forge-git.nix {
inherit pkgs;
forgeDomain = forge;
};
helperOn =
unit:
lib.any (
p: builtins.isAttrs p && (p.name or "") == "git-credential-hive-forge"
) allLocal.systemd.services.${unit}.path;
env = unit: allLocal.systemd.services.${unit}.environment;
in
helperOn "hive-c0re"
&& helperOn "hive-priv"
&& !(helperOn "swarm-controller")
&& lib.hasInfix "[credential \"http://${forge}\"]\nhelper =\nhelper = hive-forge" git.config
&& lib.hasInfix "[url \"http://${forge}/\"]\ninsteadOf = https://${forge}/" git.config
&& (env "hive-priv").HIVE_PRIV_FORGE_URL == "http://${forge}"
&& (env "hive-priv").HIVE_PRIV_FORGE_URL == (env "hive-c0re").HIVE_FORGE_URL;
}
{
# `hyperhive_rev` defaults to none on the controller, so a settings JSON
# without the key is accepted and the pin would never move: the key has
# to be there, carrying the option it is wired from.
name = "the controller hands its running rev to the meta flake settings";
ok =
let
settings = builtins.fromJSON allLocal.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_META_FLAKE;
in
settings ? hyperhive_rev
&& settings.hyperhive_rev == allLocal.services.hyperhive.c0re.hyperhiveRev
&& settings ? git_base;
}
{
# An agent connects to the queue with its own secret, so the hive hands
# its agents no shared credential and no token endpoint to mint one at.