vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents fetch the hive CA from bao at boot instead of the meta flake embedding it

Browse source
This commit is contained in:
atlas 2026-10-19 18:46:34 +02:00 • committed by mara
commit d547b521f6
12 changed files with 329 additions and 246 deletions
Download patch file Download diff file Expand all files Collapse all files

32
nix/module-eval/agent-forge-bao.nix
View file

@ -47,6 +47,38 @@ let
in
let
cases = [
{
# ../agent-modules/hive-ca.nix. Presence arm first (the unit, the
# timer, the trust variables, and every consumer ordered after the
# unit and requiring it), then the absence arm for an agent with no
# store, which has no root to fetch.
name = "an agent with a store address fetches the swarm root and its consumers wait for it";
ok =
let
svc = agentForgeBao.systemd.services;
unit = "hive-agent-trust-bundle.service";
bundle = "/run/hive-agent-trust-bundle/bundle.pem";
consumers = [
"hive-agent"
"hive-bash-daemon"
"hive-subagent-daemon"
"hive-mcp-http"
"hive-forge-notify"
"forge-avatar-sync"
];
in
svc ? hive-agent-trust-bundle
&& agentForgeBao.systemd.timers ? hive-agent-trust-bundle
&& lib.hasInfix "/v1/pki/ca/pem" svc.hive-agent-trust-bundle.script
&& agentForgeBao.systemd.globalEnvironment.SSL_CERT_FILE == bundle
&&
agentForgeBao.systemd.globalEnvironment.NODE_EXTRA_CA_CERTS
== "/run/hive-agent-trust-bundle/root.pem"
&& lib.all (c: lib.elem unit svc.${c}.after && lib.elem unit svc.${c}.requires) consumers
&& !(agentForgeNoBao.systemd.services ? hive-agent-trust-bundle)
&& !(agentForgeNoBao.systemd.globalEnvironment ? SSL_CERT_FILE)
&& !(lib.elem unit (agentForgeNoBao.systemd.services.hive-agent.after or [ ]));
}
{
# The whole switch is the store address, as for the queue credential.
name = "an agent with a store address fetches its forge token";