vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

drop the applied repo: the hive keeps no copy of an agent's config, only the deploy markers. Refs #5913

Browse source
This commit is contained in:
damocles 2026-11-01 17:19:41 +01:00
commit 862495530c
5 changed files with 190 additions and 1634 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/agent-modules/default.nix
View file

@ -287,8 +287,8 @@ in
};
# Git is needed by claude's Bash tool (for the agent <-> manager config
# request flow) and by hive-c0re's own setup_applied.
# The per-agent `applied/<name>/flake.nix` overrides `user.name` and
# request flow).
# The per-agent `agent-configs/<name>/flake.nix` overrides `user.name` and
# `user.email` with the agent's identity — values here are `mkDefault`
# so the per-agent override wins without needing `mkForce`.
programs.git = {

5
nix/host-modules/default.nix
View file

@ -4,9 +4,8 @@
# everything; `services.hyperhive.deploy.hive-controller.enable = true`
# runs a hive on this host.
#
# Every swarm needs the forge — hive-c0re mirrors every agent's applied
# config repo into it and it's the canonical store for the meta flake
# + `internal/*` repos — but only the host with `deploy.forgejo.enable`
# Every swarm needs the forge — it's the canonical store for every agent's
# config repo, the meta flake and the `internal/*` repos — but only the host with `deploy.forgejo.enable`
# runs it (derived from `deploy.allSwarmServices`, see
# ./swarm-required-services.nix). hive-matrix is opt-in (off by default). All
# subsystems rely on `services.hyperhive.domain`, which is required

4
nix/host-modules/hive-c0re/default.nix
View file

@ -37,7 +37,7 @@ let
# Privsep splits ownership across users, so git/libgit2's dubious-
# ownership guard trips on legitimate cross-user reads: hive-c0re
# (hive-core) fetches the agent-owned proposed-config repos. The process is
# (hive-core) reads repos another user owns. The process is
# trusted and can already read the files; this gitconfig only satisfies the
# ownership guard. libgit2 honours the literal `*` (mid-path globs aren't
# supported, so per-agent repos can't be listed); in practice this process
@ -49,7 +49,7 @@ let
directory = *
[http]
# Abort a stalled fetch instead of blocking startup indefinitely. If a
# git http transfer from the forge (e.g. filling an applied mirror)
# git http transfer from the forge (e.g. the /knowledge clone)
# drops below 1 KiB/s for 30s -- forge unreachable / not ready on cold
# boot -- git fails fast rather than hanging the whole daemon.
# Pairs with GIT_TERMINAL_PROMPT=0 (no credential-prompt hang) and the

17
nix/host-modules/swarm-grafana.nix
View file

@ -1660,28 +1660,13 @@ in
for = "0s";
summary = "swarm-controller failed to mint agent {{ $labels.F_AGENT }}'s store identity; the reason is the `F_ERROR` field of the swarm-controller log line";
})
# Logged once per refused deploy request, by
# `apply_rev` in hive-c0re's swarm_status.rs; the window is
# how long the rule stays firing after it. Host journal
# records carry the tracing fields as `F_<NAME>` and no
# `hive` attribute, so the machine is `_HOSTNAME`. The unit
# filter keeps out agent logs that quote the message.
(logCountRule {
uid = "hh-config-rev-refused";
title = "config rev refused";
windowSeconds = 900;
expr = ''_time:15m _SYSTEMD_UNIT:="hive-c0re.service" _msg:"swarm events: rev not applied; nothing queued" | stats by (_HOSTNAME, F_AGENT, F_REV) count() as refusals'';
for = "0s";
summary = "{{ $labels._HOSTNAME }} refused to deploy merged config commit {{ $labels.F_REV }} of agent {{ $labels.F_AGENT }}; the reason is the `F_ERROR` field of the hive-c0re log line";
})
# Logged once per detected crash, by `emit_crash_transitions`
# in hive-c0re's crash_watch.rs (10s poll interval). Replaces
# the old per-hive dashboard `agents_crashing` banner — see
# that function's module doc for why the banner went away
# in favour of this. Host journal records carry the
# tracing fields as `F_<NAME>` and no `hive` attribute,
# so the machine is `_HOSTNAME`
# (same shape as `hh-config-rev-refused` above). The unit
# so the machine is `_HOSTNAME`. The unit
# filter keeps out an agent's own log line if one ever
# quotes the same message.
(logCountRule {

2
nix/templates/agent.nix
View file

@ -3,5 +3,5 @@
imports = [ ../agent-modules ];
# Entry-point for sub-agent containers. Referenced from `flake.nix`
# (`nixosConfigurations.agent-base`) and the meta-flake's
# `applied/<name>/flake.nix`.
# `agent-configs/<name>/flake.nix`.
}