| Filename | Latest commit message | Latest commit date |
|---|---|---|
51035eac1d
A flake declares agent archetypes in its `hyperhiveArchetypes` output,
`<name> = { module; meta; }`. The hyperhive flake ships `reviewer`
(default permissions without `execution`).
swarm-builder answers `$SWARM.builder.archetypes` with the `meta` of
every archetype its own hyperhive source declares. swarm-controller asks
once the queue connects and every 10 minutes, checks each archetype as
`POST /api/agents` checks its settings, and stores the result in the
`agent-archetypes` KV bucket when it changed. `GET /api/archetypes`
serves it, and the create form's archetype select prefills permissions,
resource caps and inference from it.
The agent created is an ordinary agent with its own config repo; the
archetype's module is not applied yet.
Refs #5386
|
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
swarm-builder
The swarm builder's build service, in the swarm-builder container on the
host that sets deploy.builder.enable. The design is
docs/swarm/builder.md.
swarm-controller sends one request per config PR head: an agent, a commit and
the PR. This service builds that agent config on the agent base this host was
deployed with, through the host's nix daemon, and answers with the system
closure's store path or the tail of what nix printed. The controller turns
the answer into a swarm-builder commit status on the PR's head.
What a build is
nix buildofnix/builder/check-flake'scheckoutput, with its three inputs overridden:hyperhiveandnixpkgsto this host's own sources, andagenttogit+https://<forge>/agent-configs/<agent>?ref=refs/pull/<pr>/head&rev=<rev>.- The evaluation runs here, pure; the builds run in the host daemon's sandbox as an untrusted client, so a config can neither set daemon options nor read this service's environment.
- Nothing is pushed and nothing is recorded: the closure stays in the host's store until it is collected.
Credentials
The container holds one credential: its own store certificate, which nspawn
hands in at start without a copy on disk. With it the service reads its
queue client secret at start and again when authelia refuses it, and its
read-only forge token at every build.
git gets the token through a credential helper reading the child's
environment, never in a URL or an argument, and the helper answers only an
https request for the forge's host. Its store role reads exactly
those two paths.
Archetypes
The service also answers archetype evaluations: nix eval of the meta of
every hyperhiveArchetypes entry in this host's hyperhive source, with
nixpkgs pointed at this host's. It fetches nothing and uses no token, and it
doesn't wait for a running build. See
docs/swarm/archetypes.md.