79a29873e3
Both webhook registrations (knowledge push + config-PR pull_request) now
use the public hive domain instead of loopback:
https://<HYPERHIVE_HIVE_DOMAIN>/webhook/{knowledge,config-pr}
This routes deliveries through the gateway, bypassing the Forgejo SSRF
guard that blocked loopback delivery and silently broke the config-PR
merge flow since launch.
Changes:
- webhook_secret: new module — auto-generate + persist a 32-byte HMAC
secret to STATE_ROOT/webhook-secret on first startup; verify
X-Hub-Signature-256 on every incoming webhook POST (HMAC-SHA256).
- forge/mod.rs: ensure_config_pr_webhook now takes hive_domain +
webhook_secret; sets secret in Forgejo hook config.
- workers/knowledge.rs: ensure_webhook same update.
- dashboard/webhook.rs: both handlers read raw Bytes first, verify HMAC,
then parse JSON. Returns 401 on signature mismatch.
- dashboard/mod.rs: AppState carries webhook_secret; serve() takes it.
- main.rs: load/generate secret at startup; pass to registration tasks
+ dashboard; add 5-minute config-PR polling fallback task.
- forge/config_pr_poll.rs: new — scan agent-configs/* for open PRs with
no pending MergeConfigPr approval; queue them. Idempotent.
- stores/approvals.rs: has_pending_merge_config_pr() for poll dedup.
- nix/modules/hive-gateway.nix: remove dashboardAuth from /webhook/
location (HMAC replaces basic auth for webhook endpoints; Forgejo
cannot send HTTP Basic credentials with webhook deliveries).
93 lines
2.2 KiB
TOML
93 lines
2.2 KiB
TOML
[workspace]
|
|
resolver = "3"
|
|
members = [
|
|
"hive-ag3nt",
|
|
"hive-bash-mcp",
|
|
"hive-c0re",
|
|
"hive-claude",
|
|
"hive-forge",
|
|
"hive-matrix-mcp",
|
|
"hive-metric",
|
|
"hive-priv",
|
|
"hive-sh4re",
|
|
]
|
|
|
|
[workspace.package]
|
|
edition = "2024"
|
|
version = "0.1.0"
|
|
|
|
[workspace.lints.clippy]
|
|
pedantic = { level = "warn", priority = -1 }
|
|
# Tolerated stylistic pedantic lints (noisy, not actionable).
|
|
missing_errors_doc = "allow"
|
|
missing_panics_doc = "allow"
|
|
module_name_repetitions = "allow"
|
|
must_use_candidate = "allow"
|
|
|
|
[workspace.dependencies]
|
|
anyhow = "1"
|
|
libc = "0.2"
|
|
axum = { version = "0.8", features = ["ws"] }
|
|
base64 = "0.22"
|
|
bcrypt = "0.19"
|
|
chrono = { version = "0.4", default-features = false, features = [
|
|
"serde",
|
|
"std",
|
|
] }
|
|
clap = { version = "4", features = ["derive"] }
|
|
clap_complete = "4"
|
|
indicatif = "0.17"
|
|
hive-sh4re = { path = "hive-sh4re" }
|
|
hive-claude = { path = "hive-claude" }
|
|
thiserror = "2"
|
|
tower-http = { version = "0.6", features = ["fs"] }
|
|
rmcp = { version = "1.7", default-features = false, features = [
|
|
"server",
|
|
"macros",
|
|
"transport-io",
|
|
"transport-streamable-http-server",
|
|
] }
|
|
rusqlite = { version = "0.37" }
|
|
schemars = "1.0"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
similar = "2"
|
|
tokio = { version = "1", features = [
|
|
"fs",
|
|
"io-util",
|
|
"macros",
|
|
"net",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
"sync",
|
|
"time",
|
|
] }
|
|
tokio-stream = { version = "0.1", features = ["sync"] }
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
reqwest = { version = "0.12", default-features = false, features = [
|
|
"json",
|
|
"rustls-tls",
|
|
] }
|
|
hyper = { version = "1", features = ["client", "http1"] }
|
|
hyper-util = { version = "0.1", features = ["tokio"] }
|
|
http-body-util = "0.1"
|
|
forgejo-api = { version = "0.11", default-features = false, features = [
|
|
"rustls-tls",
|
|
] }
|
|
url = "2"
|
|
time = { version = "0.3", default-features = false, features = [
|
|
"formatting",
|
|
"parsing",
|
|
] }
|
|
petgraph = { version = "0.8", default-features = false, features = ["std"] }
|
|
matrix-sdk = { version = "0.14", default-features = false, features = [
|
|
"rustls-tls",
|
|
"sqlite",
|
|
"markdown",
|
|
"e2e-encryption",
|
|
] }
|
|
futures-util = "0.3"
|
|
hmac = "0.12"
|
|
sha2 = "0.10"
|