Watch

atlas 5950363a10 swarm-controller: render, lock and commit internal/meta

A new update_meta node renders internal/meta's flake.nix with
hive-meta-flake, the renderer hive-c0re uses: hyperhive pinned to its
forge main, each custom agent a hive places pinned to its agent-configs
main, all over https, and the swarm-wide values from
SWARM_CONTROLLER_META_FLAKE (set by swarm-controller.nix from
services.hyperhive.swarm.*). The swarm builder locks it, and the
controller commits flake.nix and flake.lock in one commit and gives
every hive's forge account read on the repo. A render equal to the
committed flake.nix sends no lock and commits nothing.

It runs at start, when hyperhive's main moves, before the deploy of a
merged config PR and before the first deploy of a new agent; those
deploys now wait for it. agent_web_port moves into hive-meta-flake so
both callers compute the same port; hive-c0re re-exports it.

On deploy: internal/meta appears on the forge and follows every merge.
No hive builds from it yet.

Refs #4857

2026-10-24 21:13:24 +02:00

2.2 KiB

Raw Blame History

swarm-builder

The swarm builder's build service, in the swarm-builder container on the host that sets deploy.builder.enable. The design is docs/swarm/builder.md.

swarm-controller sends one request per config PR head: an agent, a commit and the PR. This service builds that agent config on the agent base this host was deployed with, through the host's nix daemon, and answers with the system closure's store path or the tail of what nix printed. The controller turns the answer into a swarm-builder commit status on the PR's head.

What a build is

nix build of nix/builder/check-flake's check output, with its three inputs overridden: hyperhive and nixpkgs to this host's own sources, and agent to git+https://<forge>/agent-configs/<agent>?ref=refs/pull/<pr>/head&rev=<rev>.
The evaluation runs here, pure; the builds run in the host daemon's sandbox as an untrusted client, so a config can neither set daemon options nor read this service's environment.
Nothing is pushed and nothing is recorded: the closure stays in the host's store until it is collected.

Credentials

The container holds one credential: its own store certificate, which nspawn hands in at start without a copy on disk. With it the service reads its queue client secret at start and again when authelia refuses it, and its read-only forge token at every build. git gets the token through a credential helper reading the child's environment, never in a URL or an argument, and the helper answers only an https request for the forge's host. Its store role reads exactly those two paths.

Archetypes

The service also answers archetype evaluations: nix eval of the meta of every hyperhiveArchetypes entry in this host's hyperhive source, with nixpkgs pointed at this host's. It fetches nothing and uses no token, and it doesn't wait for a running build. See docs/swarm/archetypes.md.

Meta-flake lock

The service also locks the swarm meta flake on request: nix flake lock of the flake.nix it was sent, in a scratch directory, with the build's forge credential. It answers with the lock and commits nothing. See docs/swarm/builder.md.

2.2 KiB Raw Blame History