vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
hyperhive/hive-c0re
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas 1db2ac26a7 deploy: split the forge's host decisions out of swarm.forge 
`swarm.*` is what a hive needs to be a *client* of the swarm. For the
forge that is what it IS from any hive's point of view: its package, the
names and ports it answers on, the URLs it advertises, and the client id
it is registered under. How it is served, what it mirrors and where its
host-local secrets sit are decisions of the machine running it, so
behindGateway, openFirewall, mirrors, sso.clientSecretFile and
hostSwarmControllerTokenFile move to `deploy.forgejo.*`.

Unlike the wireguard mesh this SPLITS a module rather than relocating a
whole namespace. `sso` splits with it: `clientId` stays because it must
match the id in authelia's register, while the secret beside it is a
path on one host. Moving the whole `sso` block for symmetry with `ci`
was considered and rejected on exactly that asymmetry.

Declared in hive-forge/default.nix under the `deploy.*` path, following
swarm-victorialogs.nix; deploy.nix carries only the renames. `mirrors`
renames in one entry rather than one per field — it is a single option
of a list-of-submodule type, so the rename carries its whole value,
where `ci` needed five because it is a plain attrset of options.

Readers outside the module: hive-ci.nix binds `deploy.forgejo` for its
behindGateway assertion; swarm-authelia.nix and swarm-controller.nix
read theirs off the `deployCfg` they already bind. hivectl's `open`
printed `services.hyperhive.forge.behindGateway` in an operator-facing
hint — a path that never existed, missing `swarm.` — and hive-c0re's
state_snapshot doc comment carried the same defect; both now name the
new path. The rendered docs put the two halves on separate pages, so
the five descriptions of staying options that explain themselves in
terms of `behindGateway` now qualify it in full.

module-eval gains a forge case configured entirely through the old
paths, asserting the rendered firewall ports and the mirror env var
c0re seeds from: the new paths evaluate fine without the shims, so
dropping them reads as a clean tree. All five old paths are defined in
the fixture, so removing any single shim entry fails the eval rather
than only the two the assertion reads.
2026-09-07 14:24:52 +02:00
..
src deploy: split the forge's host decisions out of swarm.forge 2026-09-07 14:24:52 +02:00
Cargo.toml hive-c0re: deliver an agent's credential from the store to its state dir 2026-09-03 00:29:52 +02:00
README.md docs: restructure into topic subdirectories, collapse duplicated index 2026-09-02 01:55:37 +02:00

README.md

hive-c0re

The unprivileged host daemon (runs as hive-core). Owns the sqlite broker, the approval/reminder/schedule queues, the generic job-DAG queue, container lifecycle, gateway/forge/matrix provisioning, per-container stats, and the axum operator dashboard. Largest crate in the workspace — bin-only, no separate lib.

When to use it

Host-level, cross-container orchestration: spawning/rebuilding/ destroying agent containers, the approval flow, dashboard-visible state, provisioning per-agent forge/matrix/gateway accounts. Agent-side behavior (turn loop, MCP tools) lives in hive-agent/hive-agent-mcp instead — this daemon only talks to agents over the socket wire types in hive-sh4re.

Shape

Cohesive clusters live in directory submodules, each re-exported at the crate root (crate::broker::… keeps resolving regardless of which subdirectory a module actually lives in). One line each — read the module's own //! doc-comment for real detail, don't expect this file to track it:

  • dashboard/ — the operator dashboard (containers, approvals, schedules, logs, topology).
  • job_queue/ — the job-DAG queue + desired-state reconciliation (docs/scheduler/coordinator.md).
  • lifecycle/ — nixos-container lifecycle + per-agent config flake generation.
  • stores/ — sqlite-backed stores (broker, queues, audit, power).
  • workers/ — background sweeps (crash watch, scheduled prompts, auto-update, knowledge sync).
  • agent_config/ — per-agent registries (tool groups, capabilities, resource limits, topology).
  • stats/ — dashboard metrics aggregation + OTEL export.
  • socket_server/ — the unix-socket request server shared by per-agent + manager sockets.
  • forge/ — optional Forgejo wiring (docs/integrations/forge.md).
  • coordinator.rs — top-level wiring for serve.
  • meta.rs, migrate.rs — the meta flake + schema/state migrations.
  • matrix.rs, gateway_nginx.rs, webhook_secret.rs, priv_client.rs — matrix provisioning, gateway vhosts, webhook secrets, and the hive-priv client respectively.

See the top-level CLAUDE.md/docs/ index for the full reading-path map.