240 lines
9.8 KiB
Nix
240 lines
9.8 KiB
Nix
# This agent's own egress-proxy credential, fetched from the swarm secret store
|
||
# by the agent itself, and the proxy environment built from it.
|
||
#
|
||
# `swarm-controller` mints the credential at
|
||
# `swarm/agents/<agent>/proxy-credential`
|
||
# (`swarm_secret_client::proxy::agent_credential_path`); the hive's squid checks
|
||
# it against the hash `hive-c0re` renders. This unit logs in with the
|
||
# certificate ./bao.nix keeps current, reads the agent's own path, and writes
|
||
# `proxy.env` for the units below to load as an `EnvironmentFile=`:
|
||
#
|
||
# - `HTTPS_PROXY` and `HTTP_PROXY`, upper and lower case, with the credential in
|
||
# the URL's userinfo, which Claude Code, Node, curl, git and reqwest send as
|
||
# `Proxy-Authorization`;
|
||
# - `NODE_USE_ENV_PROXY=1`, without which Node's global `fetch` ignores them;
|
||
# - `NO_PROXY` and `no_proxy`.
|
||
#
|
||
# The file is written only when the credential AND the hive's facts are both
|
||
# there. `HIVE_SQUID_PROXY` (the proxy's address) and `HIVE_EGRESS_NO_PROXY` (the
|
||
# hosts that skip it) are written by a hive whose squid checks credentials and
|
||
# applies each agent's flag; on any other hive the agent has no proxy variable
|
||
# and reaches the internet directly. The units load the file with a leading `-`,
|
||
# so an agent without it is unchanged. A failed read keeps the file already in
|
||
# place, and units read it when they start, so an agent takes the proxy at its
|
||
# next start.
|
||
#
|
||
# `NO_PROXY` is the loopback names and the hive's list as it is: squid refuses
|
||
# every destination that resolves to the bridge, and the hive's resolver answers
|
||
# the bridge address for the swarm's services. Node has no CIDR support, so the
|
||
# list holds the bridge as an address.
|
||
{
|
||
pkgs,
|
||
lib,
|
||
config,
|
||
...
|
||
}:
|
||
let
|
||
cfg = config.services.hyperhive.agent.bao;
|
||
agentCfg = config.services.hyperhive.agent;
|
||
|
||
# The name `swarm-controller` minted the credential under — see ./queue-identity.nix.
|
||
agentName = agentCfg.user.name;
|
||
|
||
# The server CA id ./bao.nix loads.
|
||
serverCaCredential = "hive-agent-bao-server-ca";
|
||
|
||
unitName = "hive-agent-proxy-credential";
|
||
|
||
# The nix half of `swarm_secret_client::proxy::agent_credential_path` plus
|
||
# `path::MOUNT`.
|
||
credentialPath = "secret/swarm/agents/${agentName}/proxy-credential";
|
||
|
||
runtimeDir = unitName;
|
||
envFile = "/run/${runtimeDir}/proxy.env";
|
||
# Beside the file, so the rename that replaces it stays in one directory.
|
||
stagingFile = "/run/${runtimeDir}/proxy.env.new";
|
||
secretFile = "/run/${runtimeDir}/secret.new";
|
||
# bao's stderr, in the unit's own `0700` directory rather than `/tmp`.
|
||
errFile = "/run/${runtimeDir}/bao.err";
|
||
|
||
# Written by `hive-priv` into every container (./hive-facts.nix). The two
|
||
# egress facts are read here and nowhere else: the generator there exports
|
||
# only the keys it names, so neither reaches a unit's environment.
|
||
factsFile = "/etc/hyperhive-hive-facts";
|
||
|
||
loopback = [
|
||
"localhost"
|
||
"127.0.0.1"
|
||
"::1"
|
||
];
|
||
|
||
# The store's address is the whole switch, as in ./bao.nix and
|
||
# ./forge-token.nix.
|
||
configured = cfg.addr != null;
|
||
|
||
storeRetry = import ../host-modules/lib/store-retry.nix { };
|
||
|
||
# Units that make outbound calls: the harness and the claude it starts, the
|
||
# bash tool and the subagents it runs, MCP servers, and the pollers. They
|
||
# exist under the same conditions as their definitions, because a unit that
|
||
# is not defined would be generated inert.
|
||
consumers = [
|
||
"hive-agent"
|
||
"hive-bash-daemon"
|
||
"hive-subagent-daemon"
|
||
"hive-mcp-http"
|
||
"hive-forge-notify"
|
||
]
|
||
++ lib.optional (agentCfg.matrixAccounts != { }) "hive-matrix-daemon"
|
||
++ lib.optional agentCfg.github.enable "hive-github-notify"
|
||
++ lib.optional (agentCfg.icon != null && agentCfg.forge.url != null) "forge-avatar-sync";
|
||
in
|
||
{
|
||
config = lib.mkIf configured {
|
||
systemd.services = {
|
||
${unitName} = {
|
||
description = "fetch this agent's egress-proxy credential from the secret store";
|
||
after = [
|
||
"network.target"
|
||
# Ordering only: that unit reports a store this agent cannot reach as
|
||
# itself.
|
||
"hive-agent-bao-identity.service"
|
||
];
|
||
wantedBy = [ "multi-user.target" ];
|
||
path = [
|
||
pkgs.openbao
|
||
pkgs.coreutils
|
||
pkgs.diffutils
|
||
];
|
||
# ../host-modules/lib/store-retry.nix.
|
||
inherit (storeRetry) startLimitBurst startLimitIntervalSec;
|
||
serviceConfig = storeRetry.serviceConfig // {
|
||
Type = "oneshot";
|
||
# Not `RemainAfterExit`: the timer below has to be able to start this
|
||
# unit again. `RuntimeDirectoryPreserve` keeps the file between runs.
|
||
RemainAfterExit = false;
|
||
TimeoutStartSec = 30;
|
||
User = agentName;
|
||
Group = agentName;
|
||
RuntimeDirectory = runtimeDir;
|
||
RuntimeDirectoryMode = "0700";
|
||
RuntimeDirectoryPreserve = "yes";
|
||
UMask = "0177";
|
||
LoadCredential = [ serverCaCredential ];
|
||
};
|
||
environment = {
|
||
BAO_ADDR = cfg.addr;
|
||
BAO_CLIENT_CERT = cfg.clientCertFile;
|
||
BAO_CLIENT_KEY = cfg.clientKeyFile;
|
||
};
|
||
script = ''
|
||
set -euo pipefail
|
||
|
||
# No identity delivered: ./bao.nix's check reports that.
|
||
for f in "$BAO_CLIENT_CERT" "$BAO_CLIENT_KEY"; do
|
||
if [ ! -s "$f" ]; then
|
||
echo "this agent has no store identity, so it cannot fetch its egress-proxy credential." >&2
|
||
exit 0
|
||
fi
|
||
if [ ! -r "$f" ]; then
|
||
echo "cannot read $f, so this agent cannot present its store identity." >&2
|
||
exit 1
|
||
fi
|
||
done
|
||
|
||
# The hive says its squid checks each agent's credential and applies
|
||
# its flag by writing both facts. Without them (a hive that predates
|
||
# them) there is no proxy to name, and the store is not asked.
|
||
proxy= direct=
|
||
if [ -r ${factsFile} ]; then
|
||
while IFS='=' read -r key value || [ -n "$key" ]; do
|
||
case "$key" in
|
||
HIVE_SQUID_PROXY) proxy=$value ;;
|
||
HIVE_EGRESS_NO_PROXY) direct=$value ;;
|
||
esac
|
||
done < ${factsFile}
|
||
fi
|
||
if [[ ! "$proxy" =~ ^[0-9]+(\.[0-9]+){3}:[0-9]+$ || ! "$direct" =~ ^[A-Za-z0-9.,_-]+$ ]]; then
|
||
echo "this hive's facts name no squid proxy, so this agent stays direct." >&2
|
||
exit 0
|
||
fi
|
||
|
||
if [ -s "$CREDENTIALS_DIRECTORY/${serverCaCredential}" ]; then
|
||
export BAO_CACERT="$CREDENTIALS_DIRECTORY/${serverCaCredential}"
|
||
fi
|
||
|
||
err=${lib.escapeShellArg errFile}
|
||
trap 'rm -f "$err" ${lib.escapeShellArg stagingFile} ${lib.escapeShellArg secretFile}' EXIT
|
||
|
||
# 🩸 Every exit below that is not a rename leaves ${envFile} as it
|
||
# was: a store that is briefly unreachable, or has no credential for
|
||
# this agent yet, must not take a working proxy away, and must not
|
||
# invent one.
|
||
rm -f "$err"
|
||
if ! BAO_TOKEN="$(bao login -method=cert -token-only 2>"$err")"; then
|
||
echo "could not log in to the swarm secret store at $BAO_ADDR; the proxy settings in place, if any, are kept:" >&2
|
||
if [ -s "$err" ]; then cat "$err" >&2; fi
|
||
exit 1
|
||
fi
|
||
export BAO_TOKEN
|
||
|
||
# ⚠️ Written by redirect, never echoed: the field is the secret.
|
||
rm -f "$err" ${lib.escapeShellArg secretFile}
|
||
if ! bao kv get -field=value ${lib.escapeShellArg credentialPath} > ${lib.escapeShellArg secretFile} 2>"$err"; then
|
||
echo "no egress-proxy credential at ${credentialPath} yet; this agent sends no proxy variables until there is one." >&2
|
||
if [ -s "$err" ]; then cat "$err" >&2; fi
|
||
exit 0
|
||
fi
|
||
secret="$(<${lib.escapeShellArg secretFile})"
|
||
|
||
# The controller mints base64url, which needs no escaping in a URL's
|
||
# userinfo or an env file. Anything else is not that secret.
|
||
if [[ ! "$secret" =~ ^[A-Za-z0-9_-]+$ ]]; then
|
||
echo "the value at ${credentialPath} is not a base64url secret, so no proxy variables are written." >&2
|
||
exit 1
|
||
fi
|
||
|
||
no_proxy=${lib.escapeShellArg (lib.concatStringsSep "," loopback)},$direct
|
||
url="http://${agentName}:$secret@$proxy"
|
||
|
||
rm -f ${lib.escapeShellArg stagingFile}
|
||
{
|
||
printf 'HTTPS_PROXY=%s\n' "$url"
|
||
printf 'HTTP_PROXY=%s\n' "$url"
|
||
printf 'https_proxy=%s\n' "$url"
|
||
printf 'http_proxy=%s\n' "$url"
|
||
printf 'NODE_USE_ENV_PROXY=1\n'
|
||
printf 'NO_PROXY=%s\n' "$no_proxy"
|
||
printf 'no_proxy=%s\n' "$no_proxy"
|
||
} > ${lib.escapeShellArg stagingFile}
|
||
|
||
if cmp -s ${lib.escapeShellArg stagingFile} ${lib.escapeShellArg envFile}; then
|
||
echo "this agent's proxy settings are unchanged."
|
||
exit 0
|
||
fi
|
||
mv -f ${lib.escapeShellArg stagingFile} ${lib.escapeShellArg envFile}
|
||
echo "wrote this agent's proxy settings from ${credentialPath}."
|
||
'';
|
||
};
|
||
}
|
||
// lib.genAttrs consumers (_: {
|
||
# `wants`, not `requires`: a store outage must not stop the harness, which
|
||
# then starts direct. `after` waits for one attempt.
|
||
wants = [ "${unitName}.service" ];
|
||
after = [ "${unitName}.service" ];
|
||
# A list, which merges with the entries other modules give a unit.
|
||
serviceConfig.EnvironmentFile = [ "-${envFile}" ];
|
||
});
|
||
|
||
# The controller re-checks every agent's credential every five minutes; the
|
||
# fetch picks one up within about ten more.
|
||
systemd.timers.${unitName} = {
|
||
description = "re-fetch this agent's egress-proxy credential from the secret store";
|
||
wantedBy = [ "timers.target" ];
|
||
timerConfig = {
|
||
OnUnitInactiveSec = "10min";
|
||
RandomizedDelaySec = "1min";
|
||
};
|
||
};
|
||
};
|
||
}
|