e2da5509ae
The CI runner was a hive deploy module: hive-ci.nix ran it beside the forge, and hive-c0re registered it through the forge's admin API with the `core` token, writing the registration token through hive-priv. It could only run on the forge's host, and it kept an admin-scoped forge token on a hive. Now the runner is a swarm service: - swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the host that sets deploy.ci-runner.enable, reaching the forge by name. It needs neither the forge nor a hive there. - swarm-controller reads the forge's runner registration token with its own admin token and writes it to swarm/services/ci-runner/ registration-token whenever it differs from what it last wrote. Its grant on that path is create/update only. - The runner's own leaf (CN swarm-ci-runner, role and policy of the same name) reads that one path. swarm-bao-ci-runner.service fetches it into the runner's EnvironmentFile and restarts the runner on a change. - A pre-start step removes .runner when the daemon's journal since its last start holds Forgejo's "unregistered runner" refusal (the daemon exits 1 when its startup Declare gets it), or when .runner names another forge address; upstream's pre-start step then registers again. Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*, forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner. The forge's half of the old ci.enable, the actions/checkout mirror and DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf. Closes #4954
112 lines
4.3 KiB
HTML
112 lines
4.3 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<title>hyperhive // LOGS</title>
|
|
<link rel="icon" type="image/svg+xml" href="/favicon.svg" />
|
|
<link rel="stylesheet" href="/static/colors.css" />
|
|
<link rel="stylesheet" href="/static/theme.css" />
|
|
<link rel="stylesheet" href="/static/common.css" />
|
|
<link rel="stylesheet" href="/static/logs.css" />
|
|
</head>
|
|
<body class="logs-shell">
|
|
<!-- Minimal chrome: back link + sub-tab strip.
|
|
Same pattern as flow.html — no full dashboard tabbar. Back link
|
|
points to the H0M3 hub (served at /), not the dashboard.
|
|
Three sub-tabs: AGENT, INFRA, SYSTEM. Build log history has
|
|
moved to /builds.html (the build lifecycle hub). -->
|
|
<header class="page-header">
|
|
<a class="page-back" href="/">← home</a>
|
|
<hive-tab-strip
|
|
class="hive-tabbar logs-tabbar"
|
|
id="logs-tabbar"
|
|
prefix="logs"
|
|
role="tablist"
|
|
></hive-tab-strip>
|
|
</header>
|
|
|
|
<main class="logs-main">
|
|
<!-- AGENT: journald viewer for a specific agent container.
|
|
Agent selector + unit filter + line count. Backed by
|
|
GET /api/journal/{agent}?unit=<unit>&lines=N. -->
|
|
<section
|
|
class="logs-pane"
|
|
id="logs-pane-agent"
|
|
data-tab-pane="agent"
|
|
role="tabpanel"
|
|
aria-labelledby="logs-tab-agent"
|
|
>
|
|
<div class="logs-toolbar">
|
|
<select id="agent-select" class="journal-unit"></select>
|
|
<select id="agent-unit-select" class="journal-unit">
|
|
<option value="hive-agent.service">hive-agent.service</option>
|
|
<option value="hive-mcp-http.service">hive-mcp-http.service</option>
|
|
<option value="hive-bash-daemon.service">
|
|
hive-bash-daemon.service
|
|
</option>
|
|
<option value="hive-matrix-daemon.service">
|
|
hive-matrix-daemon.service
|
|
</option>
|
|
<option value="">(full machine journal)</option>
|
|
</select>
|
|
<button type="button" class="btn btn-restart" id="agent-refresh">
|
|
↻ refresh
|
|
</button>
|
|
<span id="agent-fetch-ts" class="meta logs-fetch-ts" hidden></span>
|
|
</div>
|
|
<pre id="agent-output" class="journal-output">
|
|
select an agent above</pre
|
|
>
|
|
</section>
|
|
|
|
<!-- INFRA: journald viewer for infrastructure containers (hive-forge,
|
|
hive-gateway, hive-matrix). Always fetches the full
|
|
machine journal — no unit filter (infra containers don't run the
|
|
per-agent hive daemons). Backed by GET /api/journal/{name}?lines=N.
|
|
Deep-link: ?agent=hive-forge routes here instead of the AGENT tab. -->
|
|
<section
|
|
class="logs-pane"
|
|
id="logs-pane-infra"
|
|
data-tab-pane="infra"
|
|
role="tabpanel"
|
|
aria-labelledby="logs-tab-infra"
|
|
>
|
|
<div class="logs-toolbar">
|
|
<select id="infra-select" class="journal-unit"></select>
|
|
<button type="button" class="btn btn-restart" id="infra-refresh">
|
|
↻ refresh
|
|
</button>
|
|
<span id="infra-fetch-ts" class="meta logs-fetch-ts" hidden></span>
|
|
</div>
|
|
<pre id="infra-output" class="journal-output">
|
|
select a container above</pre
|
|
>
|
|
</section>
|
|
|
|
<!-- SYSTEM: host-side service logs. Shows the hive-c0re daemon
|
|
journal via GET /api/journal-host?unit=hive-c0re.service. -->
|
|
<section
|
|
class="logs-pane"
|
|
id="logs-pane-system"
|
|
data-tab-pane="system"
|
|
role="tabpanel"
|
|
aria-labelledby="logs-tab-system"
|
|
>
|
|
<div class="logs-toolbar">
|
|
<select id="system-unit-select" class="journal-unit">
|
|
<option value="hive-c0re.service">hive-c0re.service</option>
|
|
<option value="hive-priv.service">hive-priv.service</option>
|
|
</select>
|
|
<button type="button" class="btn btn-restart" id="system-refresh">
|
|
↻ refresh
|
|
</button>
|
|
<span id="system-fetch-ts" class="meta logs-fetch-ts" hidden></span>
|
|
</div>
|
|
<pre id="system-output" class="journal-output">loading…</pre>
|
|
</section>
|
|
</main>
|
|
|
|
<script type="module" src="/static/logs.js" defer></script>
|
|
</body>
|
|
</html>
|