Watch

atlas 07852cabc1 feat(3088): move the gateway's nginx + dnsmasq onto the host

The gateway's nginx + dnsmasq no longer run in their own nspawn container.
`nix/host-modules/hive-gateway/default.nix` loses the
`containers.hive-gateway` wrapper and everything that existed only to punch
holes in it: `privateNetwork = false`, `CAP_NET_ADMIN`, five bind mounts,
its own `stateVersion`, `networking.firewall.enable = false`,
`networking.resolvconf.enable = false`, and the `hive-gateway-resolv`
path+service pair. 465 -> 303 lines.

The container never bought isolation here. It shared the host netns by
necessity — nginx binds the host's :80/:443, dnsmasq answers on the bridge —
so each of those settings was undoing a boundary the gateway could not
afford in the first place.

Four things made it more than a deletion, none of them visible in the nix
diff:

- The self-signed cert service also imports the hive CA leaf, so removing it
  with the container would have left nginx naming a missing cert file, which
  it refuses to load at all.
- The nginx reload is a hive-priv verb. It still needs root, but no longer
  for the reason its doc gave, and `--machine=` was both transport and
  scope — so the unit name is now hard-coded in the helper as the
  containment.
- The lifecycle verb named a container that stops existing.
- `journalctl -M hive-gateway` had no machine to enter.

Per the operator's ruling, the operator verb keeps working and agents lose
it. `InfraContainer` answered three questions that used to share an answer;
it now splits into `name()` (identity), `target()` (Container vs HostUnit),
`service_unit()` (the systemd unit), and `agent_restartable()`, which the
MCP restart path checks before the capability so the refusal cannot read as
"ask for infra_admin". `SIBLING_CONTAINERS` drops the gateway — it gates the
requests that name a container as a string — while `FromStr` still accepts
it, because that answers what a name is, not who may act on it. The
dashboard's gateway journal reads host journald filtered to `nginx.service`.

Prose was corrected where it only named a location, and re-argued where the
container was doing security work: a `0666` per-agent socket was safe
because only the gateway container had the directory bind-mounted. There is
no mount now, so the directory permissions are the whole of the access
control — the constraint holds, its mechanism doesn't.

Gate: nix fmt / clippy --all-targets -D warnings / cargo test all clean (710
tests); hivectl-cli.md regenerated from the clap tree. The nix eval was run
in both TLS shapes at this commit: every delta in the rendered
virtualHosts is one of the three intended path moves, dnsmasq settings are
byte-identical, and the absence probe flips true -> false with bindMounts
emptied.

2026-08-11 18:01:03 +02:00

4.1 KiB

Raw Blame History

Scheduling and diagnostics tools

`scheduling` tool group

Scheduled prompts fan a message body out to one or more agent inboxes at a future time, optionally recurring. All scheduling ops go through the operator approval queue (even self-targeted schedules — use remind for unapproved self-wake). Authorization for read/cancel/edit ops: you can act on schedules you own or any owned by a sub-agent in your topology subtree.

`request_schedule_prompt(targets, body, first_fire_at_unix, interval_seconds?, description?)`

Queue an operator-approval for a scheduled prompt. On approve, body is fanned out to each agent in targets at first_fire_at_unix (Unix timestamp). Recurring when interval_seconds is set, one-shot otherwise.

Catch-up clamp: if hive-c0re is down across multiple intervals, only ONE delayed fire happens on resume (per recurring schedule). The skipped-cycle count surfaces in the per-target last_result for audit.

`edit_schedule(id, body?, description?, interval_seconds?, next_fire_at_unix?, targets_add?, targets_remove?)`

Partial-update a schedule. Pass only the fields to change; absent fields are left alone. targets_add / targets_remove mutate the recipient list in the same transaction — re-adding a previously cancelled target drops its tombstone and starts fresh. interval_seconds accepts positive values only via this tool (omit to keep the existing cadence; pass a new positive value to change it). Toggling recurring → one-shot (clearing the interval) is operator-only via the dashboard PATCH endpoint. Refuses cancelled rows (terminal state).

`cancel_schedule(id, targets?)`

Cancel a schedule. Omit targets / pass empty to cancel the whole schedule; pass a list to cancel just those recipients (the schedule auto-cancels when every target is removed).

`fire_schedule_now(id)`

Fire a scheduled prompt out of band immediately. Recurring schedules keep their cadence — the manual fire is additive. One-shot schedules are consumed by the manual fire and cancelled afterwards.

`list_schedules()`

Snapshot every schedule (active + cancelled-but-not-reaped): id, owner, body, per-target last_fired_at + last_result, next_fire_at_unix, interval_seconds. Use to look up an id before cancelling, or to audit upcoming wake-ups across the swarm.

`diagnostics` tool group

`get_logs(agent, lines?)`

Fetch recent journal lines for a sub-agent container. Useful for diagnosing MCP-registration failures, startup crashes, plugin install errors, or any harness issue you can't see from inside the container.

Pass the plain logical agent name (e.g. "gui") — hive-c0re resolves the machine name (h-<name>). lines defaults to 50, host-capped at 500.

`read_host_journal` capability

Capability-gated (not a tool group) — the operator enables it in the P3RM1SS10NS C4P4B1L1T13S section. Unlike tool groups this is not configurable from agent.nix.

`get_host_journal(unit?, container?, lines?, priority?, grep?, since?, until?)`

Fetch recent lines from the host journal (requires read_host_journal capability). Useful when you need visibility outside your own container — infrastructure services, hive-c0re lifecycle events, or another container's boot log.

unit — filter to a systemd unit (e.g. hive-c0re.service).
container — nspawn machine name verbatim. Agent containers use the h-<name> prefix (e.g. h-iris); infrastructure containers use their full name (e.g. hive-ci, hive-forge, hive-matrix). Omit for the host journal. The gateway has no machine — its nginx runs on the host, so read it with unit: nginx.service and no container.
lines — how many lines to return (default 30, max 100).
priority — minimum syslog level (emerg … debug).
grep — regex matched against log message fields (journalctl --grep).
since / until — time bounds (e.g. -1h, 2024-01-01 12:00:00).

4.1 KiB Raw Blame History

Scheduling and diagnostics tools

scheduling tool group

request_schedule_prompt(targets, body, first_fire_at_unix, interval_seconds?, description?)

edit_schedule(id, body?, description?, interval_seconds?, next_fire_at_unix?, targets_add?, targets_remove?)

cancel_schedule(id, targets?)

fire_schedule_now(id)

list_schedules()

diagnostics tool group

get_logs(agent, lines?)

read_host_journal capability

get_host_journal(unit?, container?, lines?, priority?, grep?, since?, until?)

See also