vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/hive-sh4re
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas 92559af8e7 gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd 
The dashboard, its API, the swagger UI and the agent routes move to their
own vhost, `swarm.dashboardDomain` = `<hive>.hives.<swarm.domain>`, under
the swarm domain so authelia's session cookie reaches it. `/`, `/api/` and
`/api/docs/` ask authelia through `auth_request`, and authelia's
`operatorsOnly` rule for each hive's dashboard name lets only the admins
group in. The hive domain keeps matrix discovery and redirects every other
path to the new name.

The name rides as a SAN on the hive's own gateway leaf: the per-hive bao
role allows it, and hive-tls asks for it and checks coverage.

HTTP Basic auth is gone: the htpasswd writer and its test, the
`hivectl gateway` verbs and host-socket requests, the `gateway.auth`
options (now a removed-option error), the unauthorized page and the bcrypt
dependency. tmpfiles deletes a leftover gateway.htpasswd, which held
bcrypt hashes at 0644.

c0re hands out dashboard and agent URLs on the new name
(HYPERHIVE_DASHBOARD_DOMAIN), and the swarm controller's hive roster
carries each hive's dashboard name for the swarm UI's hive list.

Closes #3469
2026-10-15 21:44:27 +02:00
..
src gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd 2026-10-15 21:44:27 +02:00
Cargo.toml agent permissions: one set, tool groups included, set at agent creation 2026-10-15 18:01:40 +02:00
README.md hive-c0re: remove the approvals subsystem 2026-10-04 23:55:32 +02:00

README.md

hive-sh4re

The shared payload vocabulary between hive-c0re and the in-container harness — the common types (Message, LooseEnd, HelperEvent, …) that the per-socket wire protocols are built from. The request/response envelopes themselves now live in the per-socket crates (below); this crate holds the payloads they carry.

Where it sits

This is the shared payload crate; the per-socket protocol envelopes have been split into their own smaller crates so specialised binaries don't have to pull in all of hive-sh4re:

  • hive-host-sock — host admin socket (hivectl ↔ hive-c0re)
  • hive-core-agent-sock — per-agent/manager socket (/run/hive/mcp.sock)
  • hive-priv-sock — the privileged-helper socket

Those crates re-export or reference the payload types that still live here (Message, LooseEnd, …).

Modules

  • wire_time — the timestamp convention: wire fields are chrono::DateTime<Utc> (serialized RFC 3339), while sqlite storage + input args stay unix-epoch i64; this module owns the two boundary conversions.
  • paths — well-known on-disk path helpers.
  • assets — resolves bundled runtime asset paths (branding, prompts) under HIVE_ASSETS_DIR.

Agent-name fields are typed as hive_types::Ident for serde-validated parsing at the socket boundary.