vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/swarm-builder
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas de323a72dd swarm-builder: lock the swarm meta flake on request 
A request on $SWARM.builder.lock-meta carries a rendered flake.nix. The
builder writes it into a scratch directory, runs `nix flake lock` there
with the same forge credential helper its builds use, answers with the
flake.lock nix wrote, and removes the directory. It commits nothing; the
controller commits the lock beside the flake.

Locks are answered in their own loop, like archetype evaluations, so one
does not wait behind an hour-long build. The auth callout grants the
subject to the builder (subscribe) and the controller (publish) only.

Ported from c574a1694 onto the swarm-wire crate.

Refs #4857
2026-10-24 21:13:24 +02:00
..
src swarm-builder: lock the swarm meta flake on request 2026-10-24 21:13:24 +02:00
Cargo.toml move the builder and claude login wire contracts into swarm-wire 2026-10-18 12:36:45 +02:00
README.md the meta flake takes docs from the pinned hyperhive input 2026-10-18 20:09:14 +02:00

README.md

swarm-builder

The swarm builder's build service, in the swarm-builder container on the host that sets deploy.builder.enable. The design is docs/swarm/builder.md.

swarm-controller sends one request per config PR head: an agent, a commit and the PR. This service builds that agent config on the agent base this host was deployed with, through the host's nix daemon, and answers with the system closure's store path or the tail of what nix printed. The controller turns the answer into a swarm-builder commit status on the PR's head.

What a build is

  • nix build of nix/builder/check-flake's check output, with its three inputs overridden: hyperhive and nixpkgs to this host's own sources, and agent to git+https://<forge>/agent-configs/<agent>?ref=refs/pull/<pr>/head&rev=<rev>.
  • The evaluation runs here, pure; the builds run in the host daemon's sandbox as an untrusted client, so a config can neither set daemon options nor read this service's environment.
  • Nothing is pushed and nothing is recorded: the closure stays in the host's store until it is collected.

Credentials

The container holds one credential: its own store certificate, which nspawn hands in at start without a copy on disk. With it the service reads its queue client secret at start and again when authelia refuses it, and its read-only forge token at every build. git gets the token through a credential helper reading the child's environment, never in a URL or an argument, and the helper answers only an https request for the forge's host. Its store role reads exactly those two paths.

Archetypes

The service also answers archetype evaluations: nix eval of the meta of every hyperhiveArchetypes entry in this host's hyperhive source, with nixpkgs pointed at this host's. It fetches nothing and uses no token, and it doesn't wait for a running build. See docs/swarm/archetypes.md.