README: split the diagram into every-hive vs one-host-per-swarm, move forge/matrix into the swarm tier

mara, on review: forge and matrix are swarm-level too (both are
swarm-wide singletons per their own module comments - one Forgejo,
one Matrix homeserver, not one per hive), and the single combined tree
made the host separation unclear. Split into two trees: everything a
hive host always runs, and everything that runs once per swarm on
whichever host opts in (can be the same host or a different one).
This commit is contained in:
iris 2026-08-24 19:15:41 +02:00 committed by mara
commit f51fa921b4

View file

@ -18,7 +18,7 @@ the substrate.
- blast radius = container
```
host (NixOS, runs hive-c0re.service)
every hive (NixOS host, runs hive-c0re.service)
├── operator
│ ├── browser → :80 (hive-gateway) dashboard + per-agent UIs
@ -28,24 +28,25 @@ host (NixOS, runs hive-c0re.service)
├── hive-c0re (Rust daemon: lifecycle / broker / approvals /
│ auto-update / dashboard / sockets)
├── optional containers
│ ├── hive-gateway nginx — proxies :80 → c0re dashboard + per-agent sockets
│ ├── hive-forge Forgejo — per-agent accounts, config mirror (agent-configs/)
│ └── hive-matrix tuwunel — Matrix homeserver + per-agent accounts
├── hive-gateway (optional) nginx — proxies :80 → c0re dashboard + per-agent sockets
├── agent containers
│ ├── h-ruth manager (privileged MCP surface, approval gating)
│ └── h-<name> sub-agent (claude + MCP tools + per-agent web UI + unix socket)
└── agent containers
├── h-ruth manager (privileged MCP surface, approval gating)
└── h-<name> sub-agent (claude + MCP tools + per-agent web UI + unix socket)
one host per swarm (optional — connects hives; can be any hive, including
one that's also running the tree above)
└── swarm (optional — connects hives; one host per swarm runs these)
├── swarm-controller cross-hive state: hive directory, agent roster, jobs
├── swarm-ui swarm-wide SPA, served straight off the gateway (no own container)
├── swarm-authelia SSO — one login gates swarm-ui + Grafana + more
├── swarm-nats message queue (JetStream KV: hive-status, …)
├── swarm-otel telemetry collector, sole holder of the upstream credential
├── swarm-victoriametrics metrics store
├── swarm-victorialogs log store
└── swarm-grafana dashboards over the metrics/log stores, own OIDC login
├── hive-forge Forgejo — swarm-wide singleton, per-agent accounts + config mirror
├── hive-matrix tuwunel — swarm-wide singleton, Matrix homeserver + per-agent accounts
├── swarm-controller cross-hive state: hive directory, agent roster, jobs
├── swarm-ui swarm-wide SPA, served straight off the gateway (no own container)
├── swarm-authelia SSO — one login gates swarm-ui + Grafana + more
├── swarm-nats message queue (JetStream KV: hive-status, …)
├── swarm-otel telemetry collector, sole holder of the upstream credential
├── swarm-victoriametrics metrics store
├── swarm-victorialogs log store
└── swarm-grafana dashboards over the metrics/log stores, own OIDC login
```
**[→ website](https://hyperhive.darkest.space)** ·