| Filename | Latest commit message | Latest commit date |
|---|---|---|
72f5e39278
A self-signed hive fronting no swarm service name never filled `$svcroot` (/var/lib/hive-tls/swarm-services-root.pem): the only writer was `swarm-services-cert`'s issuance, which exits early on `want_svc=0`. So those hives' trust-bundle.pem lacked the store's `pki` root, even though every other hive's swarm-service names chain to it. On `want_svc=0`, `swarm-services-cert` now reads the root from the store's unauthenticated `GET /v1/pki/ca/pem`, over the hive's existing BAO_ADDR, `deploy.bao.serverCaFile` and reader identity (`deploy.bao.clientCertFile`/`clientKeyFile`) at the TLS layer only; no login. It writes `$svcroot` and restarts `hive-tls-ca` when the root changed, as the issuing path already does. The daily `swarm-services-cert-renew` timer runs the same script, so the copy follows a root rotation. The gateway no longer `Requires=` `swarm-services-cert` on such a host: nginx reads nothing that unit writes there, and the fetch retries against a sealed store. `hivectl peer-config` prints the root as step 2 of the self-signed instructions: the swarm's service names are issued under it, not the swarm root. No new option. Refs #4588. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
hivectl
The operator-facing host CLI. A thin client for the hive-c0re
daemon — speaks the host admin socket protocol (hive-host-sock) and
does not link the daemon crate. Container lifecycle, the approval
queue, and the matrix/gateway verbs all forward to the daemon
and need it running; a few (wg/peer-config, choom) work off local
host state instead.
When to use it
Reach for this crate when adding an operator-run host command — agents
talk to the daemon over their own MCP tool surface
(hive-agent-mcp), not this binary. hivectl is what a human operator
(or a host-side script) runs.
Shape
One module per subcommand family; main.rs is just the clap parse +
dispatch:
agents.rs— container lifecycle for an EXISTING agent (start/stop/kill/rebuild/restart/…); creation is swarm-level (swarmctl agent create).approvals.rs— the config/spawn/meta-input approval queue.dag_progress.rs— rebuild-queue progress rendering.power.rs— restart/start/stop at the container level.choom.rs— drop into an interactive claude session in a container.forge.rs— reconciles an agent's config against its forge repo.matrix.rs— invite a matrix user to the hive Space or a room.gateway.rs— gateway Basic-auth user management (htpasswd).wg.rs— WireGuard mesh helpers.subvol.rs— btrfs state-subvolume ops.quota.rs,util.rs,completions.rs,open.rs— shared helpers, shell completions, browser-open.
Full verb reference: docs/tools/hivectl.md.