vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents fetch the hive CA from bao at boot instead of the meta flake embedding it

Browse source
This commit is contained in:
atlas 2026-10-19 18:46:34 +02:00 • committed by mara
commit d547b521f6
12 changed files with 329 additions and 246 deletions
Download patch file Download diff file Expand all files Collapse all files

32
nix/module-eval/agent-forge-bao.nix
View file

@ -47,6 +47,38 @@ let
in
let
cases = [
{
# ../agent-modules/hive-ca.nix. Presence arm first (the unit, the
# timer, the trust variables, and every consumer ordered after the
# unit and requiring it), then the absence arm for an agent with no
# store, which has no root to fetch.
name = "an agent with a store address fetches the swarm root and its consumers wait for it";
ok =
let
svc = agentForgeBao.systemd.services;
unit = "hive-agent-trust-bundle.service";
bundle = "/run/hive-agent-trust-bundle/bundle.pem";
consumers = [
"hive-agent"
"hive-bash-daemon"
"hive-subagent-daemon"
"hive-mcp-http"
"hive-forge-notify"
"forge-avatar-sync"
];
in
svc ? hive-agent-trust-bundle
&& agentForgeBao.systemd.timers ? hive-agent-trust-bundle
&& lib.hasInfix "/v1/pki/ca/pem" svc.hive-agent-trust-bundle.script
&& agentForgeBao.systemd.globalEnvironment.SSL_CERT_FILE == bundle
&&
agentForgeBao.systemd.globalEnvironment.NODE_EXTRA_CA_CERTS
== "/run/hive-agent-trust-bundle/root.pem"
&& lib.all (c: lib.elem unit svc.${c}.after && lib.elem unit svc.${c}.requires) consumers
&& !(agentForgeNoBao.systemd.services ? hive-agent-trust-bundle)
&& !(agentForgeNoBao.systemd.globalEnvironment ? SSL_CERT_FILE)
&& !(lib.elem unit (agentForgeNoBao.systemd.services.hive-agent.after or [ ]));
}
{
# The whole switch is the store address, as for the queue credential.
name = "an agent with a store address fetches its forge token";

6
nix/module-eval/core-toggle.nix
View file

@ -317,6 +317,12 @@ let
in
e.HIVE_AGENT_BAO_ADDR == e.BAO_ADDR;
}
{
name = "an agent is told the mount its swarm root is read from, only where it is told the store";
ok =
allLocal.systemd.services.hive-c0re.environment.HIVE_AGENT_BAO_SERVICES_PKI_MOUNT == "pki"
&& !(bare.systemd.services.hive-c0re.environment ? HIVE_AGENT_BAO_SERVICES_PKI_MOUNT);
}
{
# A hive with no certificate of its own can collect no agent's identity,
# so forwarding an address would name a store nothing in the container

5
nix/module-eval/hive-tls.nix
View file

@ -693,10 +693,7 @@ let
let
bundle = "/var/lib/hive-tls/trust-bundle.pem";
envOf = m: unit: m.systemd.services.${unit}.environment or { };
hiveVars = [
"HIVE_TLS_CA_PATH"
"HIVE_C0RE_OIDC_CA_FILE"
];
hiveVars = [ "HIVE_C0RE_OIDC_CA_FILE" ];
anyOf =
m: unit: vars:
lib.any (v: (envOf m unit) ? ${v}) vars;