Watch

Repository files (latest commit first)
Filename	Latest commit message	Latest commit date
atlas d30cb7d122 keep authelia's oidc client secrets in the store, not on disk The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone.		2026-10-30 16:57:58 +01:00
..
src	keep authelia's oidc client secrets in the store, not on disk	2026-10-30 16:57:58 +01:00
Cargo.toml	make squid's allowed domains editable at runtime in the swarm ui	2026-10-28 23:01:43 +01:00
README.md	describe core/meta as the legacy permission repo; drop stale meta-flake prose	2026-10-25 15:32:16 +01:00

README.md

hive-c0re

The unprivileged host daemon (runs as hive-core). Owns the sqlite broker, the reminder queue, the generic job-DAG queue, container lifecycle, gateway vhost wiring, forge/matrix config reconciliation, per-container stats, and the axum operator dashboard. Largest crate in the workspace — bin-only, no separate lib.

When to use it

Host-level, cross-container orchestration: spawning/rebuilding/ destroying agent containers, dashboard-visible state, wiring each agent's gateway vhost and reconciling its forge config-repo access and matrix room membership. The accounts themselves are swarm-controller's (docs/integrations/forge.md). Agent-side behavior (turn loop, MCP tools) lives in hive-agent/hive-agent-mcp instead — this daemon only talks to agents over the socket wire types in hive-sh4re.

Shape

Cohesive clusters live in directory submodules, each re-exported at the crate root (crate::broker::… keeps resolving regardless of which subdirectory a module actually lives in). One line each — read the module's own //! doc-comment for real detail, don't expect this file to track it:

dashboard/ — the operator dashboard (containers, schedules, logs, topology).
job_queue/ — the job-DAG queue + desired-state reconciliation (docs/scheduler/coordinator.md).
lifecycle/ — nixos-container lifecycle + per-agent config flake generation.
stores/ — sqlite-backed stores (broker, queues, audit, power).
workers/ — background sweeps (crash watch, autoupdate, knowledge sync).
agent_config/ — per-agent registries (permissions, resource limits, topology).
stats/ — dashboard metrics aggregation + OTEL export.
socket_server/ — the unix-socket request server for the per-agent sockets.
forge/ — optional Forgejo wiring (docs/integrations/forge.md).
coordinator.rs — top-level wiring for serve.
meta_rev.rs — which internal/meta commit an agent builds from, and the markers a successful build writes. agent_set.rs — the files that follow the agent set (topology, gateway map). meta.rs — the commit that removes the legacy permission seed files. migrate.rs — schema/state migrations.
matrix.rs, gateway_nginx.rs, priv_client.rs — matrix provisioning, gateway vhosts, and the hive-priv client respectively.

See the top-level AGENTS.md/docs/ index for the full reading-path map.