also stop provisioning the hive space and make hivectl matrix invite take a room
This commit is contained in:
damocles
parent
c0dc4b07f4
commit
fd01848d4d
5 changed files with 83 additions and 437 deletions
|
|
@ -111,12 +111,11 @@ container keeps starting with the hive meanwhile.
|
|||
|
||||
## 5 · Matrix
|
||||
|
||||
Your matrix account comes from SSO. Invite it to the hive Space, and
|
||||
optionally to rooms:
|
||||
Your matrix account comes from SSO. Invite it to the rooms you want it in:
|
||||
|
||||
```bash
|
||||
hivectl matrix invite mara
|
||||
hivectl matrix invite @mara:yourserver --room '#some-room:yourserver'
|
||||
hivectl matrix invite mara --room '#some-room:yourserver'
|
||||
hivectl matrix invite @mara:yourserver --room '!abc:yourserver'
|
||||
```
|
||||
|
||||
## 6 · Your first agent
|
||||
|
|
|
|||
|
|
@ -96,8 +96,7 @@ and federation peers all reach the homeserver at `chat.<swarm-domain>`
|
|||
through the gateway; from outside the host that takes
|
||||
`gateway.openFirewall`.
|
||||
|
||||
hive-c0re provisions matrix (its own sender login, the hive Space and
|
||||
invites) through `swarm.matrix.apiUrl`, which defaults to
|
||||
hive-c0re talks to matrix (its own sender login, invites) through `swarm.matrix.apiUrl`, which defaults to
|
||||
`https://<swarm.matrix.gatewayHost>` on every hive. That login carries
|
||||
the hive's matrix access token, and on a hive that doesn't run the
|
||||
homeserver it crosses the network, so the default is TLS; hive-c0re
|
||||
|
|
@ -258,9 +257,8 @@ token and gets a refusal on any other hive's. The name says what it
|
|||
authenticates as — an account the swarm's appservice creates — rather
|
||||
than any privilege level, because it carries none.
|
||||
|
||||
It needs no promotion for what the hive does with it. Creating the hive
|
||||
Space and inviting agents into it are ordinary client calls that ride on
|
||||
being the Space's own creator at power level 100 — there is no homeserver
|
||||
It needs no promotion for what the hive does with it. Inviting a user into a
|
||||
room it has the power in is an ordinary client call — there is no homeserver
|
||||
admin in any of it, and no Synapse admin API to reach for either, since
|
||||
tuwunel has none.
|
||||
|
||||
|
|
@ -346,27 +344,17 @@ Initial rollout settings:
|
|||
stored yet the account comes up without backup and picks it up on the
|
||||
next daemon start. A failure is a `WARN` and never stops the daemon.
|
||||
|
||||
## Hive Matrix Space
|
||||
## Hive sender token
|
||||
|
||||
On first boot hive-c0re creates a private **Matrix Space** named `"hive"` using its own hive
|
||||
account (`@hive-<hive>:<server_name>`) and invites every provisioned agent
|
||||
into it. This gives the operator a single Space in FluffyChat or any
|
||||
Matrix client that groups all agent-to-agent + operator rooms in one
|
||||
place.
|
||||
hive-c0re keeps the hive's `@hive-<hive>:` sender token on disk for
|
||||
`hivectl matrix invite`, refreshed from the swarm secret store by the
|
||||
matrix sweep (at boot, then every 30 minutes).
|
||||
|
||||
**State**: hive-c0re persists the Space's room ID to
|
||||
`/var/lib/hyperhive/matrix/space-room-id` (mode `0600`, owned by the
|
||||
hive-c0re service user). The path is **outside** every agent state dir and
|
||||
**isn't** deleted by `nixos-container destroy --purge`, so it survives full
|
||||
agent purges, and hive-c0re reuses it on re-provision.
|
||||
|
||||
An earlier version also provisioned a `hive-chat` room and kept its id in
|
||||
`chat-room-id`. The sweep no longer touches either; an existing room and
|
||||
file are harmless leftovers, so delete them by hand if you like.
|
||||
|
||||
**Idempotent**: if the file exists and is non-empty, hive-c0re considers the
|
||||
Space already created. Delete the file to force re-creation (for example
|
||||
after a homeserver wipe).
|
||||
Earlier versions also created a private "hive" Matrix Space and a
|
||||
`hive-chat` room, invited every agent to both, and kept their ids in
|
||||
`/var/lib/hyperhive/matrix/space-room-id` and `chat-room-id`. The sweep no
|
||||
longer touches any of them. The rooms and files are harmless leftovers, so
|
||||
delete them by hand if you like.
|
||||
|
||||
## Configuration tuning
|
||||
|
||||
|
|
|
|||
|
|
@ -73,7 +73,7 @@ Cheap — no build slot:
|
|||
| `EmitRebuilt` | tail of a rebuild — emit the agent's `Rebuilt` manager event (ok/fail per outcome, nothing on cancel). One node per agent _and_ per outcome |
|
||||
| `WriteDropin` | `set_nspawn_flags` + `set_resource_limits` + daemon-reload |
|
||||
| `ForgeSweep` | one-shot boot-time publish of the hive's forge read token for nix (`forge::ensure_all`) as a first-class node, so it shows as real work on the dashboard instead of running invisibly in a bare `tokio::spawn`. Agentless |
|
||||
| `MatrixSweep` | matrix user/space sweep (`matrix::ensure_all`): the boot-time instance, plus one every 30 min from a loop in `main.rs`. Holds `Resource::MatrixSweep` (capacity 1), so two passes never overlap; each tick queues its own pass, which waits for the resource if one is already live. Agentless |
|
||||
| `MatrixSweep` | matrix sender-token sweep (`matrix::ensure_all`): the boot-time instance, plus one every 30 min from a loop in `main.rs`. Holds `Resource::MatrixSweep` (capacity 1), so two passes never overlap; each tick queues its own pass, which waits for the resource if one is already live. Agentless |
|
||||
| `KnowledgePull` | `/knowledge` pull (`knowledge::pull`): at boot (commits that landed while `hive-c0re` was down), on the swarm knowledge-changed event, and hourly as a fallback. Holds `Resource::KnowledgeTree` (capacity 1), so two pulls never overlap on the working tree; each trigger queues its own pass, which waits for the resource if one is already live. Agentless |
|
||||
| `WantedPull` | pull of the agent set the swarm controller declares for this hive (`wanted::pull`), converging the agents it names. Runs at boot, waiting up to a minute in total for the queue connection, and again after every attach of the wanted-state watch (which retries with a backoff when the attach fails or the stream ends); the deploy event (`swarm_status`) and the watch are the fast path, this repairs a missed one. A first deploy already queued or running for an agent isn't queued again. Agentless |
|
||||
|
||||
|
|
|
|||
|
|
@ -116,21 +116,21 @@ Always prints the diff first. `--from forge` resets the local checkout to forge
|
|||
|
||||
matrix-tuwunel invites.
|
||||
|
||||
Manual invites into the hive Space and its rooms; c0re's periodic matrix sweep provisions the Space and the agents' invites on its own.
|
||||
Manual invites into a room by id or alias.
|
||||
|
||||
**Usage:** `hivectl matrix <COMMAND>`
|
||||
|
||||
###### **Subcommands:**
|
||||
|
||||
* `invite` — Invite a matrix user to the hive Space, or a specific room with `--room`. Idempotent
|
||||
* `invite` — Invite a matrix user to a room. Idempotent
|
||||
|
||||
|
||||
|
||||
## `hivectl matrix invite`
|
||||
|
||||
Invite a matrix user to the hive Space, or a specific room with `--room`. Idempotent
|
||||
Invite a matrix user to a room. Idempotent
|
||||
|
||||
**Usage:** `hivectl matrix invite [OPTIONS] <USER>`
|
||||
**Usage:** `hivectl matrix invite --room <ROOM> <USER>`
|
||||
|
||||
###### **Arguments:**
|
||||
|
||||
|
|
@ -138,7 +138,7 @@ Invite a matrix user to the hive Space, or a specific room with `--room`. Idempo
|
|||
|
||||
###### **Options:**
|
||||
|
||||
* `--room <ROOM>` — Target room id (`!abc:server`) or alias (`#name:server`). Omit to invite to the hive Space
|
||||
* `--room <ROOM>` — Target room id (`!abc:server`) or alias (`#name:server`)
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -44,13 +44,12 @@ hivectl forge reconcile-config iris --verbose # include the full diff, not
|
|||
|
||||
## Matrix
|
||||
|
||||
Manual entry to the same idempotent matrix provisioning flow
|
||||
`hive-c0re` runs at boot. Requires the `hive-matrix` container to be
|
||||
Manual invites into a room. Requires the `hive-matrix` container to be
|
||||
running (`services.hyperhive.deploy.matrix.enable = true`).
|
||||
|
||||
```bash
|
||||
hivectl matrix invite mara # invite a user to the hive Space
|
||||
hivectl matrix invite @mara:server --room '#some-room:server' # ...or to a specific room/alias
|
||||
hivectl matrix invite mara --room '#some-room:server' # a room alias
|
||||
hivectl matrix invite @mara:server --room '!abc:server' # ...or a room id
|
||||
```
|
||||
|
||||
Human matrix accounts come from SSO, not `hivectl`; matrix homeserver
|
||||
|
|
@ -58,10 +57,9 @@ admin should eventually come from membership in authelia's `admins`
|
|||
group; nobody has built that sync yet.
|
||||
|
||||
- `invite`: invites a matrix user (full `@user:server` or a bare
|
||||
localpart, qualified with the homeserver's `server_name`) to the hive
|
||||
Space by default, or to a `--room` id / `#alias`. Uses the sender
|
||||
token; the account must be a member of the target room with
|
||||
invite power (it owns the hive Space, so that case always works).
|
||||
localpart, qualified with the homeserver's `server_name`) to the
|
||||
`--room` id / `#alias`. Uses the sender token; the account must be a
|
||||
member of the target room with invite power.
|
||||
Idempotent — already-member / already-invited is a no-op.
|
||||
|
||||
## Agents
|
||||
|
|
|
|||
Loading…
Reference in a new issue