vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/swarm-builder
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas 44984e0d36 move install_crypto_provider to swarm-secret-client 
The rustls provider install is process setup every swarm binary runs, and
swarm-secret-client depends on no other swarm crate, so a binary that only
needs the provider and the store no longer links the queue client.

- swarm-secret-client/src/lib.rs, Cargo.toml: the function, its test, a
  `//!` line on why it lives there, and the rustls dependency; rustls
  `ring` as a dev-dependency feature, so the test builds both providers as
  the binaries do and fails if the install is dropped.
- swarm-queue-client/src/lib.rs, Cargo.toml: function and test removed;
  `connect()` calls the secret client's; rustls dropped (no other use),
  swarm-secret-client added.
- swarm-metrics-auth/Cargo.toml: drop swarm-queue-client, whose only use
  was the provider; the binary no longer links async-nats.
- swarm-logs-auth, swarm-logs, swarm-metrics, swarm-ci-metrics Cargo.toml:
  the dep comment no longer names the provider (they keep the dep for
  agent_token / the OIDC mint).
- Cargo.toml: the rustls comment names the provider's new home.
- 14 call sites (hive-agent, hive-c0re, hive-subagent-mcp x2,
  swarm-builder, swarm-ci-metrics, swarm-claude-login, swarm-controller,
  swarm-logs-auth, swarm-logs, swarm-metrics-auth, swarm-metrics,
  swarm-nats-auth, swarm-review-classifier): one-line path change.
- Cargo.lock: the dependency edges above.
2026-10-18 03:18:43 +02:00
..
src move install_crypto_provider to swarm-secret-client 2026-10-18 03:18:43 +02:00
Cargo.toml swarm-builder: refuse a build that waited too long for the slot 2026-10-17 23:30:13 +02:00
README.md swarm-builder: list hyperhive-docs among the check flake's inputs in the readme 2026-10-17 13:39:42 +02:00

README.md

swarm-builder

The swarm builder's build service, in the swarm-builder container on the host that sets deploy.builder.enable. The design is docs/swarm/builder.md.

swarm-controller sends one request per config PR head: an agent, a commit and the PR. This service builds that agent config on the agent base this host was deployed with, through the host's nix daemon, and answers with the system closure's store path or the tail of what nix printed. The controller turns the answer into a swarm-builder commit status on the PR's head.

What a build is

  • nix build of nix/builder/check-flake's check output, with its four inputs overridden: hyperhive and nixpkgs to this host's own sources, hyperhive-docs to the docs/ source its hives use (c0re.hyperhiveDocs), and agent to git+https://<forge>/agent-configs/<agent>?ref=refs/pull/<pr>/head&rev=<rev>.
  • The evaluation runs here, pure; the builds run in the host daemon's sandbox as an untrusted client, so a config can neither set daemon options nor read this service's environment.
  • Nothing is pushed and nothing is recorded: the closure stays in the host's store until it is collected.

Credentials

The container holds one credential: its own store certificate, which nspawn hands in at start without a copy on disk. With it the service reads its queue client secret at start and again when authelia refuses it, and its read-only forge token at every build. git gets the token through a credential helper reading the child's environment, never in a URL or an argument, and the helper answers only an https request for the forge's host. Its store role reads exactly those two paths.

Archetypes

The service also answers archetype evaluations: nix eval of the meta of every hyperhiveArchetypes entry in this host's hyperhive source, with nixpkgs pointed at this host's. It fetches nothing and uses no token, and it doesn't wait for a running build. See docs/swarm/archetypes.md.