vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

refactor(#2431): extract hive-priv-sock crate from hive-sh4re

Browse source 
Split the priv-socket wire types (PrivRequest/PrivResponse/PrivEvent and
friends) out of hive-sh4re into their own hive-priv-sock crate, mirroring
the existing hive-host-sock split. hive-priv — the root-privileged
helper — now depends on just this narrow protocol crate instead of the
much larger daemon-shared crate, shrinking its dependency surface and
making the privsep boundary easier to audit. No server/client
implementation lives here, only the wire contract; hive-c0re still
depends on hive-sh4re directly for everything else.
This commit is contained in:
atlas 2026-07-14 19:52:12 +02:00 • committed by mara
commit e0461e1af6
18 changed files with 52 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hive-c0re/src/lifecycle/host_config.rs
View file

@ -5,7 +5,7 @@
use std::path::Path;
use anyhow::{Context, Result};
use hive_sh4re::priv_proto::{BindMount, CredentialMount};
use hive_priv_sock::{BindMount, CredentialMount};
use crate::coordinator::{AgentPaths, HiveEnv};
@ -313,7 +313,7 @@ async fn set_nspawn_flags(
%agent_name, %gateway_ip, %bridge,
"network isolation: PRIVATE_NETWORK=1 (DHCP)"
);
Some(hive_sh4re::priv_proto::NetworkIsolation { bridge, gateway_ip })
Some(hive_priv_sock::NetworkIsolation { bridge, gateway_ip })
} else {
None
}

8
hive-c0re/src/lifecycle/mod.rs
View file

@ -549,7 +549,7 @@ pub async fn is_running(name: &str) -> bool {
/// `container@<unit_name>.service` directly rather than going through
/// [`container_name`]. Used by the dashboard C0R3 page's 1NFR4 sub-tab to
/// show each infra container's live status dot.
pub async fn infra_is_running(container: hive_sh4re::priv_proto::InfraContainer) -> bool {
pub async fn infra_is_running(container: hive_priv_sock::InfraContainer) -> bool {
let unit = format!("container@{}.service", container.unit_name());
Command::new("systemctl")
.args(["is-active", "--quiet", &unit])
@ -853,8 +853,8 @@ fn make_log_callback(
logs: Option<std::sync::Arc<crate::build_logs::BuildLogs>>,
log_id: Option<i64>,
cmdline: String,
) -> impl FnMut(hive_sh4re::priv_proto::PrivStream, &str) {
use hive_sh4re::priv_proto::PrivStream;
) -> impl FnMut(hive_priv_sock::PrivStream, &str) {
use hive_priv_sock::PrivStream;
move |stream, line| match stream {
PrivStream::Stdout => {
tracing::info!(target: "nixos-container", cmdline = %cmdline, "{line}");
@ -981,7 +981,7 @@ async fn container_journal_tail(container: &str) -> String {
// is delegated to hive-priv (hive-c0re itself runs unprivileged).
let res = crate::priv_client::read_container_journal(
container,
hive_sh4re::priv_proto::JournalQuery {
hive_priv_sock::JournalQuery {
lines: 40,
..Default::default()
},