| Filename | Latest commit message | Latest commit date |
|---|---|---|
7003d14d2c
`swarm.*` is what a hive needs to be a *client* of the swarm. For the homeserver that is what it IS from anywhere: its package, the name it answers to, the ports and URLs it is reached on, and the client id it is registered under. Whether it is exposed, which peers it trusts, how large a request it accepts and where its host-local secrets sit are decisions of the machine running it, so openFirewall, trustedServers, maxRequestSize, registrationTokenFile, gui.enable and sso.clientSecretFile move to `deploy.matrix.*`. Two sub-blocks split rather than moving whole, on their own evidence. `gui.enable` is whether THIS host serves the web client; `gui.package` is which client, an artifact identity, and stays. `sso.clientSecretFile` is a path on one host; `clientId` must match the id in authelia's register, so it is swarm-wide. Each half now points at the other, because the rendered docs put them on separate pages. hive-gateway passed the whole `swarm.matrix` attrset into vhosts.nix, so that file read a moving option through an argument with no option path anywhere in it. It now takes `matrixDeployCfg` beside `matrixCfg` — the only shape that carries a split namespace across that boundary. While there: vhosts.nix read `matrixCfg.enable`, which has been a rename alias for `deploy.matrix.enable` since the enable moved. Reading it made the module system print `Obsolete option services.hyperhive.swarm.matrix. enable is used` on EVERY evaluation of every host — a deprecation warning no operator could silence, because the config tripping it was ours. That shim lives in hive-matrix.nix rather than in this file's table, which is why deploy.nix's header claim to be their single home is now qualified in the new block's comment. glue-matrix-bao-token.nix read the registration token through its own `matrixCfg` alias; with that read repointed, the binding had no reader left, so it goes, and the comment naming it is reworded. module-eval gains a case configuring a hive through all six OLD paths and asserting two rendered effects — the host firewall's port list and the container's bind-mount table — because the new paths evaluate fine without the shims. `gui.enable` is set to the opposite of its default so the definition has to land rather than agreeing with it by accident. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
hivectl
The operator-facing host CLI. A thin client for the hive-c0re
daemon — speaks the host admin socket protocol (hive-host-sock) and
does not link the daemon crate. Container lifecycle, the approval
queue, and provisioning verbs all forward to the daemon and need it
running; a few (wg/peer-config, choom) work off local host state
instead.
When to use it
Reach for this crate when adding an operator-run host command — agents
talk to the daemon over their own MCP tool surface
(hive-agent-mcp), not this binary. hivectl is what a human operator
(or a host-side script) runs.
Shape
One module per subcommand family; main.rs is just the clap parse +
dispatch:
agents.rs— container lifecycle (start/stop/create/kill/rebuild/restart/…).approvals.rs— the config/init-config/meta-input approval queue.dag_progress.rs— rebuild-queue progress rendering.power.rs— restart/start/stop at the container level.choom.rs— drop into an interactive claude session in a container.forge.rs,matrix.rs,github.rs,gateway.rs— per-integration account/token provisioning.wg.rs— WireGuard mesh helpers.subvol.rs— btrfs state-subvolume ops.quota.rs,util.rs,completions.rs,open.rs— shared helpers, shell completions, browser-open.
Full verb reference: docs/tools/hivectl.md.