vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive reads the forge for nix as its own account, not core

Browse source 
hive-c0re copies the hive's store read token to /run/hyperhive/forge-hive-token
for nix's git credential helper, and no longer mints, reads or falls back to
the core admin token. drops the core user sweep, avatar upload, webhook
cleanup and hive-priv's RunForgeAdmin.
This commit is contained in:
atlas 2026-10-25 17:56:14 +01:00
commit b79896c237
23 changed files with 236 additions and 1118 deletions
Download patch file Download diff file Expand all files Collapse all files

25
nix/host-modules/lib/hive-forge-git.nix
View file

@ -4,9 +4,9 @@
# input, so git's config is the only credential and URL plumbing it has.
#
# - `credential`: the forge host answers through `git-credential-hive-forge`,
# which reads the live `core` token file. An empty `helper =` first resets the
# list, so no /etc/gitconfig helper (e.g. `oauth`, which waits on a browser)
# runs ahead of ours.
# which reads the hive's own forge account and token from the file hive-c0re
# publishes. An empty `helper =` first resets the list, so no /etc/gitconfig
# helper (e.g. `oauth`, which waits on a browser) runs ahead of ours.
# - `url`: the swarm's `internal/meta` lock names its inputs by the forge's
# `https` URL, which only the builder's credential helper answers for. They
# are fetched over the `http` URL the helper above is scoped to.
@ -19,16 +19,18 @@
# # `forgeGit.config` into its gitconfig.
{ pkgs, forgeDomain }:
{
# Answers only `get`, for the forge `core` user, from the live token file
# (`/var/lib/hyperhive/forge-core-token`, hive-c0re's `paths::FORGE_CORE_TOKEN`)
# on every invocation, so it never holds a stale copy and survives token
# rotation; prints nothing where the file is absent.
# Answers only `get`. The file (`/run/hyperhive/forge-hive-token`, hive-c0re's
# `paths::FORGE_HIVE_TOKEN`) holds the account on its first line and the
# token on its second; it is read on every invocation, so it never holds a
# stale copy and survives token rotation. Prints nothing where the file is
# absent or incomplete.
credentialHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
[ "''${1:-}" = "get" ] || exit 0
if [ -r /var/lib/hyperhive/forge-core-token ]; then
printf 'username=core\n'
printf 'password=%s\n' "$(cat /var/lib/hyperhive/forge-core-token)"
fi
[ -r /run/hyperhive/forge-hive-token ] || exit 0
{ read -r login; read -r token; } < /run/hyperhive/forge-hive-token || true
[ -n "$login" ] && [ -n "$token" ] || exit 0
printf 'username=%s\n' "$login"
printf 'password=%s\n' "$token"
'';
config = ''
@ -37,7 +39,6 @@
[credential "http://${forgeDomain}"]
helper =
helper = hive-forge
username = core
[url "http://${forgeDomain}/"]
insteadOf = https://${forgeDomain}/
'';