vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat: add hive-ci module — Forgejo Actions runner for CI

Browse source 
Adds `services.hyperhive.ci` NixOS module that spins up a `hive-ci`
nixos-container running `gitea-actions-runner` against the hive-forge
Forgejo instance. Off by default; opt in with `ci.enable = true` after
generating a runner registration token in Forgejo.

Also adds `.forgejo/workflows/ci.yml` with four jobs: nix flake check,
formatting (nix fmt + cargo fmt), cargo test, and cargo clippy. Jobs
target the `hive-ci` runner label.

Container design mirrors hive-forge (shared host netns, non-ephemeral
state, loopback reach to forge). sandbox-fallback = true since nspawn
containers can't create user-namespaces for nix sandbox.

Closes #175.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
atlas 2026-05-31 23:24:16 +02:00 • committed by mara
commit aa7ebbcd3b
4 changed files with 283 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

86
nix/modules/hive-c0re.nix
View file

@ -22,6 +22,7 @@ in
# opt-in (off by default) and asserts that `services.hyperhive.domain`
# is set before it can be enabled.
imports = [
./hive-ci.nix
./hive-forge.nix
./hive-gateway.nix
./hive-matrix.nix
@ -99,34 +100,40 @@ in
# `identity.rs::peers()` + the dashboard's `peer_hives` state field
# (feeds the P33RS dashboard tab).
options.services.hyperhive.peers = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule {
options = {
domain = lib.mkOption {
type = lib.types.str;
example = "lab.example.com";
description = ''
DNS domain of the peer hive. Used to construct the peer's
dashboard URL (`http://''${domain}/`) and for Matrix
federation auto-discovery (`matrix.''${domain}`).
Must be reachable from this host.
'';
type = lib.types.attrsOf (
lib.types.submodule {
options = {
domain = lib.mkOption {
type = lib.types.str;
example = "lab.example.com";
description = ''
DNS domain of the peer hive. Used to construct the peer's
dashboard URL (`http://''${domain}/`) and for Matrix
federation auto-discovery (`matrix.''${domain}`).
Must be reachable from this host.
'';
};
tlsCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
Optional path to a PEM cert/bundle to trust for this peer's
TLS. Null = system CA bundle (for Let's Encrypt peers). Set
to the peer's self-signed cert for `selfSignedTls = true`
peers. Forward-compat slot; not yet used in v0.
'';
};
};
tlsCertFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
Optional path to a PEM cert/bundle to trust for this peer's
TLS. Null = system CA bundle (for Let's Encrypt peers). Set
to the peer's self-signed cert for `selfSignedTls = true`
peers. Forward-compat slot; not yet used in v0.
'';
};
};
});
}
);
default = { };
example = {
lab = { domain = "lab.example.com"; };
edge = { domain = "edge.corp"; };
lab = {
domain = "lab.example.com";
};
edge = {
domain = "edge.corp";
};
};
description = ''
Peer hives in the same swarm. The attrset key is a short label
@ -345,24 +352,29 @@ in
# links; when false it falls back to direct `<host>:<port>` TCP.
HIVE_GATEWAY_ENABLED = "1";
}
// lib.optionalAttrs (config.services.hyperhive.forge.enable && config.services.hyperhive.forge.behindGateway) {
# Public URL of the forge vhost served by hive-gateway. The
# dashboard uses this to build browser-facing forge links
# instead of hardcoding `<hostname>:3000`, which breaks when
# the operator accesses the dashboard through the gateway
# (forge sub-domain has no port; direct port URL would be
# wrong). Absent when `behindGateway = false` — dashboard
# falls back to `<hostname>:3000`.
HIVE_FORGE_PUBLIC_URL = "https://${config.services.hyperhive.forge.domain}";
}
//
lib.optionalAttrs
(config.services.hyperhive.forge.enable && config.services.hyperhive.forge.behindGateway)
{
# Public URL of the forge vhost served by hive-gateway. The
# dashboard uses this to build browser-facing forge links
# instead of hardcoding `<hostname>:3000`, which breaks when
# the operator accesses the dashboard through the gateway
# (forge sub-domain has no port; direct port URL would be
# wrong). Absent when `behindGateway = false` — dashboard
# falls back to `<hostname>:3000`.
HIVE_FORGE_PUBLIC_URL = "https://${config.services.hyperhive.forge.domain}";
}
// lib.optionalAttrs (config.services.hyperhive.peers != { }) {
# Peer hives serialised as a JSON array of {label, domain} objects.
# Consumed by hive-ag3nt::identity::peers() + the dashboard's
# peer_hives StateSnapshot field (P33RS tab). tlsCertFile is
# nix-side-only (host nginx/trust config); rust never needs the path.
HYPERHIVE_PEERS = builtins.toJSON (
lib.mapAttrsToList (label: p: { inherit label; inherit (p) domain; })
config.services.hyperhive.peers
lib.mapAttrsToList (label: p: {
inherit label;
inherit (p) domain;
}) config.services.hyperhive.peers
);
};
serviceConfig = {