| Filename | Latest commit message | Latest commit date |
|---|---|---|
d30cb7d122
The mint creates each client's secret in the swarm secret store and writes only the digest to disk. It mints only when the store answers and holds none. A new unit moves the plaintext files an earlier release left into the store and removes each once the store holds the same value. The bridge reads its secret from the store into /run before each start. The secret publisher unit and its path unit are gone. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
swarm-builder
The swarm builder's build service, in the swarm-builder container on the
host that sets deploy.builder.enable. The design is
docs/swarm/builder.md.
swarm-controller sends one request per config PR head: an agent, a commit and
the PR. This service builds that agent config on the agent base this host was
deployed with, through the host's nix daemon, and answers with the system
closure's store path or the tail of what nix printed. The controller turns
the answer into a swarm-builder commit status on the PR's head.
What a build is
nix buildofnix/builder/check-flake'scheckoutput, with its three inputs overridden:hyperhiveandnixpkgsto this host's own sources, andagenttogit+https://<forge>/agent-configs/<agent>?ref=refs/pull/<pr>/head&rev=<rev>.- The evaluation runs here, pure; the builds run in the host daemon's sandbox as an untrusted client, so a config can neither set daemon options nor read this service's environment.
- Nothing is pushed and nothing is recorded: the closure stays in the host's store until it is collected. (A meta build can push, see below.)
Meta builds
The service also builds one agent from internal/meta on request: an agent and
a commit of the repo. It runs nix build of
nixosConfigurations.<agent>.config.system.build.toplevel from that commit,
with every input at the flake's own lock, and answers with the store path and
the platform it builds for. The controller records the answer; the service
writes nothing. It takes the same one-build slot as the PR checks. See
docs/swarm/builder.md.
Where services.hyperhive.swarm.attic.{domain,cache} are not null (they default
to the swarm's own cache), it first pushes a green build's closure to that cache with attic push, and the answer says
whether that worked. A failed push leaves the build green. See
docs/swarm/builder.md.
Credentials
The container holds one credential: its own store certificate, which nspawn
hands in at start without a copy on disk. With it the service reads its
queue client secret at start and again when authelia refuses it, and its
read-only forge token at every build, and the cache push token at every push.
git gets the token through a credential helper reading the child's
environment, never in a URL or an argument, and the helper answers only an
https request for the forge's host. Its store role reads exactly
those three paths.
Archetypes
The service also answers archetype evaluations: nix eval of the meta of
every hyperhiveArchetypes entry in this host's hyperhive source, with
nixpkgs pointed at this host's. It fetches nothing and uses no token, and it
doesn't wait for a running build. See
docs/swarm/archetypes.md.
Meta-flake lock
The service also locks the swarm meta flake on request: nix flake lock of
the flake.nix it was sent, in a scratch directory, with the build's forge
credential. It answers with the lock and commits nothing. See
docs/swarm/builder.md.