vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(#2502): git credential helper for hive-core forge fetches

Browse source 
hive-core now fetches each agent's config as a forge-hosted flake input
(git+http://<forge>/agent-configs/<n>.git). Add a git credential helper
(git-credential-hive-forge) that reads the live forge-core admin token on
every invocation and authenticates as the forge core user, wired via the
[credential] stanza in hive-core's $HOME/.gitconfig + on the service PATH.
Reading the token file live means zero stale copies and no resync on
rotation; no token ever lands in a flake URL or lock. Mirrors the existing
github.nix credential-helper pattern.
This commit is contained in:
atlas 2026-07-16 18:47:42 +02:00 • committed by mara
commit b806aa253e
1 changed files with 27 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nix/host-modules/hive-c0re/default.nix
View file

@ -21,9 +21,33 @@ let
# only satisfies the ownership guard. libgit2 honours the literal `*`
# (mid-path globs aren't supported, so per-agent repos can't be listed);
# in practice these processes only ever touch hyperhive's own repos.
#
# The agent config inputs now live on the forge
# (`git+http://${forge.domain}/agent-configs/<n>.git`, see meta.rs render),
# so hive-core's `nix flake update` of those inputs is an authenticated
# `git+http` fetch. The `[credential]` stanza points git at the `hive-forge`
# helper below (scoped to the forge host) so the fetch authenticates as the
# forge `core` user with no token in any URL or lock.
safeDirGitconfig = pkgs.writeText "hyperhive-safe-gitconfig" ''
[safe]
directory = *
[credential "http://${config.services.hyperhive.forge.domain}"]
helper = hive-forge
username = core
'';
# git credential helper for hive-core's authenticated fetches of the
# agent-config repos on the forge. Reads the live forge-core admin token
# (`/var/lib/hyperhive/forge-core-token` — paths.rs `FORGE_CORE_TOKEN`) on
# every invocation, so it never holds a stale copy and survives token
# rotation. Scoped to the forge host by the `[credential]` stanza above;
# implements the git credential-helper protocol (only `get` answers).
forgeCredHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
[ "''${1:-}" = "get" ] || exit 0
if [ -r /var/lib/hyperhive/forge-core-token ]; then
printf 'username=core\n'
printf 'password=%s\n' "$(cat /var/lib/hyperhive/forge-core-token)"
fi
'';
# The `hive-c0re serve` config JSON. Keys are snake_case to match the
@ -116,6 +140,9 @@ in
after = [ "hive-c0re.socket" ];
path = [
pkgs.git
# `git-credential-hive-forge` on PATH so git finds it when nix fetches
# the forge-hosted agent-config inputs (helper = hive-forge).
forgeCredHelper
"/run/current-system/sw"
];
environment = import ./environment.nix { inherit lib config pkgs; };