e2da5509ae
The CI runner was a hive deploy module: hive-ci.nix ran it beside the forge, and hive-c0re registered it through the forge's admin API with the `core` token, writing the registration token through hive-priv. It could only run on the forge's host, and it kept an admin-scoped forge token on a hive. Now the runner is a swarm service: - swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the host that sets deploy.ci-runner.enable, reaching the forge by name. It needs neither the forge nor a hive there. - swarm-controller reads the forge's runner registration token with its own admin token and writes it to swarm/services/ci-runner/ registration-token whenever it differs from what it last wrote. Its grant on that path is create/update only. - The runner's own leaf (CN swarm-ci-runner, role and policy of the same name) reads that one path. swarm-bao-ci-runner.service fetches it into the runner's EnvironmentFile and restarts the runner on a change. - A pre-start step removes .runner when the daemon's journal since its last start holds Forgejo's "unregistered runner" refusal (the daemon exits 1 when its startup Declare gets it), or when .runner names another forge address; upstream's pre-start step then registers again. Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*, forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner. The forge's half of the old ci.enable, the actions/checkout mirror and DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf. Closes #4954
71 lines
2.3 KiB
Nix
71 lines
2.3 KiB
Nix
# The full hyperhive host stack, pulled together in one place — this
|
|
# is what the flake exports as `nixosModules.default` (wrapped with
|
|
# the package/source wiring; see flake.nix). One import covers
|
|
# everything; `services.hyperhive.deploy.hive-controller.enable = true`
|
|
# runs a hive on this host.
|
|
#
|
|
# Every swarm needs the forge — hive-c0re mirrors every agent's applied
|
|
# config repo into it and it's the canonical store for the meta flake
|
|
# + `internal/*` repos — but only the host with `deploy.forgejo.enable`
|
|
# runs it (derived from `deploy.allSwarmServices`, see
|
|
# ./swarm-required-services.nix). hive-matrix is opt-in (off by default). All
|
|
# subsystems rely on `services.hyperhive.domain`, which is required
|
|
# (asserted in hive-network.nix) wherever this host runs a hive.
|
|
{
|
|
imports = [
|
|
./hyperhive.nix
|
|
./deploy.nix
|
|
./local-defaults.nix
|
|
./hive-c0re
|
|
./hive-forge
|
|
./hive-gateway
|
|
./hive-matrix-service.nix
|
|
./hive-matrix.nix
|
|
./hive-network.nix
|
|
./hive-priv.nix
|
|
./hive-tls.nix
|
|
./otel.nix
|
|
./glue-bao-readers-policy-order.nix
|
|
./glue-bao-tls.nix
|
|
./glue-bao-ui-oidc-client.nix
|
|
./glue-controller-bao-identity.nix
|
|
./glue-controller-oidc-client.nix
|
|
./glue-forge-oidc-client.nix
|
|
./glue-grafana-oidc-client.nix
|
|
./glue-hive-tls-bao-identity.nix
|
|
./glue-matrix-ctl-bao-identity.nix
|
|
./glue-matrix-oidc-client.nix
|
|
./glue-nats-auth-bao-identity.nix
|
|
./glue-nats-bao-identity.nix
|
|
./glue-nats-oidc-client.nix
|
|
./glue-queue-agent-credential.nix
|
|
./glue-secret-publisher-bao-identity.nix
|
|
./glue-services-issuer-bao-identity.nix
|
|
./glue-swarm-bao-otel-oidc-client.nix
|
|
./glue-swarm-otel-oidc-client.nix
|
|
./swarm-authelia-service.nix
|
|
./swarm-authelia.nix
|
|
./swarm-bao-service.nix
|
|
./swarm-bao.nix
|
|
./swarm-ca.nix
|
|
./swarm-ci-runner.nix
|
|
./swarm-secret-publisher.nix
|
|
./swarm-nats-service.nix
|
|
./swarm-nats.nix
|
|
./swarm-controller.nix
|
|
./swarm-grafana-service.nix
|
|
./swarm-grafana.nix
|
|
./swarm-otel-service.nix
|
|
./swarm-otel.nix
|
|
./swarm-snapshot-store.nix
|
|
./swarm-ui.nix
|
|
./swarm-victorialogs-service.nix
|
|
./swarm-victorialogs.nix
|
|
./swarm-victoriametrics-service.nix
|
|
./swarm-victoriametrics.nix
|
|
./swarm-wireguard.nix
|
|
./swarm.nix
|
|
./swarm-peers-removed.nix
|
|
./swarm-required-services.nix
|
|
];
|
|
}
|