vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive reads the forge for nix as its own account, not core

Browse source 
hive-c0re copies the hive's store read token to /run/hyperhive/forge-hive-token
for nix's git credential helper, and no longer mints, reads or falls back to
the core admin token. drops the core user sweep, avatar upload, webhook
cleanup and hive-priv's RunForgeAdmin.
This commit is contained in:
atlas 2026-10-25 17:56:14 +01:00
commit b79896c237
23 changed files with 236 additions and 1118 deletions
Download patch file Download diff file Expand all files Collapse all files

1
nix/host-modules/hive-c0re/environment.nix
View file

@ -43,7 +43,6 @@ in
HIVE_AGENT_FRONTEND_DIR = "${cfg.servedFrontend}/agent";
# Path to the static runtime asset tree (branding + claude
# prompts). `hive_sh4re::assets::*` reads paths underneath.
# `forge/users.rs` reads the core avatar PNG from here on startup.
HIVE_ASSETS_DIR = "${cfg.assets}/share/hyperhive";
}
// {

25
nix/host-modules/lib/hive-forge-git.nix
View file

@ -4,9 +4,9 @@
# input, so git's config is the only credential and URL plumbing it has.
#
# - `credential`: the forge host answers through `git-credential-hive-forge`,
# which reads the live `core` token file. An empty `helper =` first resets the
# list, so no /etc/gitconfig helper (e.g. `oauth`, which waits on a browser)
# runs ahead of ours.
# which reads the hive's own forge account and token from the file hive-c0re
# publishes. An empty `helper =` first resets the list, so no /etc/gitconfig
# helper (e.g. `oauth`, which waits on a browser) runs ahead of ours.
# - `url`: the swarm's `internal/meta` lock names its inputs by the forge's
# `https` URL, which only the builder's credential helper answers for. They
# are fetched over the `http` URL the helper above is scoped to.
@ -19,16 +19,18 @@
# # `forgeGit.config` into its gitconfig.
{ pkgs, forgeDomain }:
{
# Answers only `get`, for the forge `core` user, from the live token file
# (`/var/lib/hyperhive/forge-core-token`, hive-c0re's `paths::FORGE_CORE_TOKEN`)
# on every invocation, so it never holds a stale copy and survives token
# rotation; prints nothing where the file is absent.
# Answers only `get`. The file (`/run/hyperhive/forge-hive-token`, hive-c0re's
# `paths::FORGE_HIVE_TOKEN`) holds the account on its first line and the
# token on its second; it is read on every invocation, so it never holds a
# stale copy and survives token rotation. Prints nothing where the file is
# absent or incomplete.
credentialHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
[ "''${1:-}" = "get" ] || exit 0
if [ -r /var/lib/hyperhive/forge-core-token ]; then
printf 'username=core\n'
printf 'password=%s\n' "$(cat /var/lib/hyperhive/forge-core-token)"
fi
[ -r /run/hyperhive/forge-hive-token ] || exit 0
{ read -r login; read -r token; } < /run/hyperhive/forge-hive-token || true
[ -n "$login" ] && [ -n "$token" ] || exit 0
printf 'username=%s\n' "$login"
printf 'password=%s\n' "$token"
'';
config = ''
@ -37,7 +39,6 @@
[credential "http://${forgeDomain}"]
helper =
helper = hive-forge
username = core
[url "http://${forgeDomain}/"]
insteadOf = https://${forgeDomain}/
'';

7
nix/module-eval/core-toggle.nix
View file

@ -257,6 +257,13 @@ let
in
helperOn "hive-c0re"
&& helperOn "hive-priv"
# The helper answers from the file hive-c0re publishes the hive's own
# token to. The first arm is the control for the second: the lookup
# finds the helper's text, so the absent `core` strings are really absent.
&& lib.hasInfix "/run/hyperhive/forge-hive-token" git.credentialHelper.text
&& !(lib.hasInfix "forge-core-token" git.credentialHelper.text)
&& !(lib.hasInfix "username=core" git.credentialHelper.text)
&& !(lib.hasInfix "username = core" git.config)
&& !(helperOn "swarm-controller")
&& lib.hasInfix "[credential \"http://${forge}\"]\nhelper =\nhelper = hive-forge" git.config
&& lib.hasInfix "[url \"http://${forge}/\"]\ninsteadOf = https://${forge}/" git.config