vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: scrub issue/PR cookies from gateway + network nix modules and gateway_nginx.rs

Browse source
This commit is contained in:
atlas 2026-05-31 23:08:07 +02:00 • committed by mara
commit d45b2f0293
3 changed files with 30 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

7
hive-c0re/src/gateway_nginx.rs
View file

@ -10,7 +10,7 @@
//! switch` needed when agents start, stop, or flip `useUnixSocket`.
//! (A path unit inside the container was tried first but `IN_MOVED_TO`
//! from the atomic rename does not cross the nspawn mount-namespace
//! boundary — see #889 for the failure analysis.)
//! boundary — see `docs/gateway.md` for the failure analysis.)
//!
//! Upstream selection mirrors `agent_sockets::build_map`: an agent
//! gets a UDS upstream when its `.bound` marker exists (harness has
@ -40,8 +40,7 @@ const HOST_CONF_PATH: &str = "/var/lib/hyperhive/gateway/agents.conf";
/// (not the whole parent dir) at `/run/hive-state/` so nginx inside
/// can read it at `/run/hive-state/agents.conf`. Subdirectory scoping
/// avoids exposing the rest of `/var/lib/hyperhive/` (which may contain
/// forge tokens or other credentials) to the gateway container (argus 🟡
/// on #872).
/// forge tokens or other credentials) to the gateway container.
#[must_use]
pub fn host_conf_path() -> PathBuf {
PathBuf::from(HOST_CONF_PATH)
@ -119,7 +118,7 @@ fn render(names: &[String]) -> String {
/// inside the container watching the bind-mounted file: `IN_MOVED_TO`
/// (fired by the atomic rename) does not reliably propagate across the
/// nspawn mount-namespace boundary, so the path-unit approach was
/// silently broken after #872 merged (#889).
/// silently broken (see `docs/gateway.md` for the failure analysis).
///
/// The `systemd-run` call is best-effort — a failed reload is logged
/// but not fatal. nginx will pick up the new include on its next