vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive reads the forge for nix as its own account, not core

Browse source 
hive-c0re copies the hive's store read token to /run/hyperhive/forge-hive-token
for nix's git credential helper, and no longer mints, reads or falls back to
the core admin token. drops the core user sweep, avatar upload, webhook
cleanup and hive-priv's RunForgeAdmin.
This commit is contained in:
atlas 2026-10-25 17:56:14 +01:00
commit b79896c237
23 changed files with 236 additions and 1118 deletions
Download patch file Download diff file Expand all files Collapse all files

33
docs/integrations/forge.md
View file

@ -16,7 +16,7 @@ each agent on relevant activity.
## Token scopes
Three scope sets:
Two scope sets:
**`AGENT_TOKEN_SCOPES`** (swarm-controller's `forge::agent_token`, pinned
by a test). swarm-controller mints every agent token with it:
@ -32,15 +32,6 @@ by a test). swarm-controller mints every agent token with it:
| `read:notification` | Poll `GET /notifications` for unread events. |
| `write:notification` | Mark notifications read via `PATCH /notifications/threads/{id}`. |
**`CORE_TOKEN_SCOPES`** (`hive-c0re::forge`, for its own `core` user): the
same set as `AGENT_TOKEN_SCOPES`, with no admin scope. Forgejo's token scope
gate runs before the user-permission check, so this token gets
`403 Forbidden` on `/api/v1/admin/*` even though `core` is a site admin.
hive-c0re only mints the token when the file at
`/var/lib/hyperhive/forge-core-token` is missing or the forge rejects it, so
a token minted with admin scopes keeps them until an operator deletes that
file and restarts hive-c0re.
**`HIVE_TOKEN_SCOPES`** (swarm-controller's `forge::hive_token`, pinned by a
test): `read:repository` alone, for each hive's read-only account (next
section).
@ -68,9 +59,8 @@ agent's account to the team or mints a token for it. An agent's own forge
account setup refuses the hive's account the same way.
hive-c0re reads the token with `forge::reader_token()`, under the hive's own
store certificate, every time it reads the forge. Where the store holds none,
it falls back to the `core` token file, which only the host running the forge
container has. These reads go through it, and none of them needs a local
store certificate, every time it reads the forge. A hive whose store holds
none reads nothing. These reads go through it, and none of them needs a local
forge container:
- fetching a merged config commit for a swarm deploy, and
@ -79,16 +69,19 @@ forge container:
- seeding `proposed` from `agent-configs/<agent>` on first deploy
- cloning and pulling `/knowledge`
The builds themselves read as `core`. nix fetches the config inputs and
The builds read as the hive's account too. nix fetches the config inputs and
`internal/meta` with `git`, and `git` gets its credential from
`git-credential-hive-forge`, which reads the `core` token file. A hive without
that file fetches nothing private through nix, whatever its own token reads, so
its builds fail: they have no other flake than `internal/meta`.
`git-credential-hive-forge`, which reads `/run/hyperhive/forge-hive-token`.
hive-c0re writes that file (account on the first line, token on the second)
from the hive's store token at each boot and each `internal/meta` read, when its
content differs. A hive whose store holds no token has no such file, fetches
nothing private through nix and fails its builds: they have no other flake than
`internal/meta`. This also holds on a hive with no forge container.
Roll a change to any of this out store host first (its granter writes the
controller's grant on `swarm/hives/+/forge/token`), then the controller host,
then the hives. A hive that starts before its token exists reads with the
core file, or not at all, until the controller's next pass.
then the hives. A hive that starts before its token exists reads nothing, and
builds nothing, until the controller's next pass.
---
@ -108,7 +101,7 @@ the avatar sync read it from there, falling back to `<state>/forge-token`,
the file hive-c0re wrote before. hive-c0re no longer creates agent users or
mints agent tokens. swarm-controller deletes the `hyperhive-<unix-seconds>`
tokens it left behind, for each agent whose current `swarm-agent` token is
live; `core`'s `hyperhive`-named admin token is never touched.
live; tokens of other names are never touched.
Two things live in the `agent-configs` Forgejo organization: