vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarmctl: --swarm works after the subcommand, takes a bare domain, and login defaults to the host's swarm

Browse source 
`swarmctl login --swarm X` failed with "unexpected argument", and
`login --help` listed no `--swarm`: the flag was only accepted before the
verb. `--swarm` and `--ca-file` are now global, so they parse on either side
of the subcommand and show in every subcommand's help.

`--swarm` / `SWARMCTL_SWARM` accept a bare domain and prepend `https://`.
A value with a scheme is parsed as before, so `http://` is still refused.

On a swarm-controller host, the swarmctl wrapper sets
`SWARMCTL_LOGIN_DEFAULT_SWARM=https://<swarm.domain>` (`--set-default`).
Only `login` reads it, after `--swarm` and `SWARMCTL_SWARM`. The wrapper
does not set `SWARMCTL_SWARM`: that would send every socket verb (agent
create, schedule, inference, forge) through the gateway and make each need
a login. Other verbs resolve exactly as before.

No CA file is wired. The only CA material the module names is the
controller's assembled trust bundle (system CAs plus the hive anchor).
`--ca-file` hands every certificate in it to rustls-platform-verifier as
an extra root, and that fails the whole client on any one it cannot
parse, so pointing it at the system CAs is a risk nothing here can test.
The controller daemon trusts the same CA through `SSL_CERT_FILE`, which
skips unparsable certificates; using that for swarmctl is left open.

Machines that are not swarm-controller hosts (an operator laptop) get no
default; that case waits on an answer in the issue.

Fixes #5239
This commit is contained in:
atlas 2026-10-14 02:42:11 +02:00 • committed by mara
commit 7d95973d83
6 changed files with 176 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/module-eval/bao-controller.nix
View file

@ -97,6 +97,12 @@ let
baoWrapperCmd = if baoWrapper == null then "" else (baoWrapper.buildCommand or "");
swarmctlWrapper = lib.findFirst (
p: (p.name or "") == "swarmctl-configured"
) null controllerNoStore.environment.systemPackages;
swarmctlWrapperCmd = if swarmctlWrapper == null then "" else (swarmctlWrapper.buildCommand or "");
refusedWithoutIdentity =
m:
lib.any (
@ -130,6 +136,16 @@ let
controllerPinnedGateway.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_MATRIX_HOMESERVER_URL
or null == "https://matrix.hive.t.local";
}
{
# Login-only: `SWARMCTL_SWARM` would move every socket verb onto the
# gateway. The socket variable is the control that the wrapper text was
# found at all.
name = "the host's swarmctl logs in to its own swarm by default, and its other verbs stay on the socket";
ok =
lib.hasInfix "--set SWARM_CONTROLLER_SOCKET " swarmctlWrapperCmd
&& lib.hasInfix "--set-default SWARMCTL_LOGIN_DEFAULT_SWARM https://t.local" swarmctlWrapperCmd
&& !(lib.hasInfix "SWARMCTL_SWARM" swarmctlWrapperCmd);
}
{
name = "a swarm with no matrix gateway vhost gives the controller no homeserver variable";
ok =